Patent ID: 7827609

Claim:
A method for tracing-back an IP on an IPv6 network, the method comprising: detecting an attack made by an attacker on the IPv6 network; if the attack is detected, extracting marking information marked by a marking router through which the packet has passed and stored on a hop-by-hop option header of a packet received through the IPv6 network; classifying received packets for each attacker using interface IDs of source addresses of received packets; aligning the marking router in the classified packets for each attacker using the address of the marking router contained in the address field and the distance contained in the distance field; comparing the address of the aligned marking router with a network ID of an adjacent router; if the address of the aligned marking router is same as the network ID; selecting the aligned marking router as a router on a reception path; and reconstructing a reception path of the received packets with the selected aligned marking router and tracing-back an IP of the attacker using the extracted marking information and the aligned marking router; if the reception path of the received packet is not reconstructed: transmitting a request message for requesting routing information of a router whose marking information is not obtained; receiving the routing information of the router that is transmitted in response to the request message; and reconstructing a reception path using the received routing information; wherein the hop-by-hop option header includes a code field, a length field, and a data field, and an option value representing an IP tracing-back contained in the code field; and wherein the marking information stored in the data field includes a distance field representing a distance from a router that performs marking to a host under attack, an address field representing an address of the router that performs marking, and a classification field representing an interface ID of a source address of the received packet.