Toggle Main Menu Toggle Search

Open Access padlockePrints

The Newcastle University research output collection, currently available on ePrints, will shortly be moving to a new open repository platform, Figshare. To prepare for the data migration we have paused adding new content to ePrints, and will resume once the new repository is launched. During this time you will continue to have access to ePrints (but no new content will appear). We will share updates here when available.

Logging Based IP Traceback in Switched Ethernets

Lookup NU author(s): Marios Andreou, Professor Aad van Moorsel

Downloads

Full text for this publication is not currently held within this repository. Alternative links are provided below where available.

Abstract

IP Traceback systems facilitate tracing of IP packets back to their origin, despite possibly forged or overwritten source address data. A common shortcoming of existing proposals is that they identify source network, but not the source host. Our work extends the traceback process to allow tracing of (switched) Ethernet frames. We build on SPIE (which operates at IP routers) to design and implement `switch-SPIE'. Traffic logging is deployed in a `switch-DGA' tap-box at each switch. The (switched) Ethernet traffic visibility issue is resolved with port mirroring, and the MAC address table establishes causality between source MAC address and source switch port. Our solution works for any network topology, as opposed to earlier layer 2 extensions to IP Traceback. We provide an implementation and experimental evaluation to establish the efficacy of our approach, with respect to processing overhead and memory use.

Publication metadata

Author(s): Andreou MS, van Moorsel A

Publication type: Conference Proceedings (inc. Abstract)

Publication status: Published

Conference Name: Proceedings of the first European Workshop on System Security (EUROSEC)

Year of Conference: 2008

Pages: 1-7

Publisher: ACM

Notes: Affiliated with EuroSys 2008. Proceedings on CD-ROM.

Share