Abstract: A new technique was presented to trace spoofed packets back to their actual source host without relying on the cooperation of intervening ISPs. An agent-based distributed architecture for tracing suspicious IP packets was outlined. An agent server was designed to record packet digests, and a security control server was designed to traceback the originator of a spoofing IP packet. The arithmetic forwarding IP packet in Unix OS was expanded. The packet digest arithmetic and the agent-based automatic tracing system were realized. The methods for identifying suspicious packets and recording packet digest were tested through the simulation experiments. The agent-based method of tracing IP packet is feasible.