System Overview ofInter-domain Packet Traceback
Inter-domain

Hiroaki Hazeyama
Ph.D of Engineering
Nara Institute of Science and Technology

Outline• Introduction• System Overview• Tests on StarBED• Analysis of Tests• Consideration2

What is Packet Traceback ?
• Technique to track the true forwarding path of a packet• By querying packet capture agents• Even when the source IP address of the target packet is spoofed• Packet Traceback is expected to track attack packets• DDoS attack, UDP exploit, spoofed DNS queries: attack packet: traceback3

System Overview
OperatorsInter-AS

Intra-AS

InterOp TTS(Inter-Operator Trouble Ticket System)(KDDI Lab)InterTrack(Inter-domain Traceback Network)(NAIST)

IP-TB(IP Packet Traceback System)(Matsushita Electric Works)

Packet Capture Probe（HW/SW）
Layer 1 / 2(KDDI Lab)
44

Packet Traceback Operation Image
Trouble shooting
TTS

AS1

ITM

AS2

ITM
archivingBTM
IPTBProbe
BTS
Probe

DPTC
IDS
IGP (OSPF,)BTM
IPTBProbe
BTS
Probe

BTS
Probe
BGP

DPTC
IDS

BTS
Probe

IGP (OSPF,)
5

Emulation Tests toward Field Tests• To reduce risks on field tests, we measured
the bellow items in Emulation Tests• Specifications of each component• Interoperability among each component• Scalability of the whole system• Estimated Traceability along with DeploymentScenarios

We ran Large Scale Emulation Tests on StarBED
6

StarBED
NICT Hokuriku Research Center
Large Scale Network Emulation / Simulation Testbed

7

Test in Dec. 2007

8

Test in Dec. 2007
• Interoperability test
• InterTrack <-> IP-TB manager <-> SW/HW probe• Checked Hash value format, Message format, Behaviors• Measured throughput on a minimum set• Practice for Emulation Test in Jan. 2008
• Create configuration templates, test scenarios and test tools• Be familiar with StarBED consoles
9Test in Jan. 2008

10

Tests in Jan. 2008
• Interoperability test
• TTS <-> InterTrack <-> IP-TB manager <-> SW probe• Verification test of the whole system• In a minimum set• Scalability test of the whole system• In an Emulated 200 AS topology in JP-Domain• Audit by a Lawyer and T-ISAC Traceback WG
11

Procedure of Emulation Tests
1. Configure PXE Boot and OS image
2. Setting a basic L2/L3 network
3. Creating an Emulated eBGP topology
4. Generating configuration files from theeBGP topology
5. Booting each software
6. Running experiments
12Snapshots of Emulation Tests

Flood Modemessage forwarding(worst case analysis)

Strict Modemessage forwarding(best case analysis)

13Throughput Analysis(in worst case)

At Rank 1 AS (89 eBGP neighbors)
1.0GHz (Pentium3) / Mem 256M→120[msg/s]

14

Ratio of # of Peers and # of messages(in worst case)According to # of peers,
ITM can apply a rate limit filter

15

Benefits from Tests in StarBED• Verified behaviors of the whole system• Measured the basic specifications• Revealed several problems and research /development topics about scalability issues• Improved the whole system as soon as
we found problems• Because all researchers and developers weregathered in StarBED
16

More and More Emulation Tests• Experiments with More reality while running
Filed Tests• Considering delay and bandwidth• More detail emulations with Intra-AS topologies• Emulation Test in All JP-domain AS topology• Test Various Scenarios• Feedback from / to actual filed tests
17

Next is the details of our field test planby Mr. Wakasa of T-ISAC-J