Patent ID: 7487541

Claim:
A method of tracking-back a single malicious data packet in a connection-oriented communication network including a network node comprising a plurality of router interfaces, the method comprising the steps of: a) for a given time window of a predetermined length, computing a flow identifier that uniquely identifies a given flow seen by a respective router interface at said network node; b) inserting said flow identifier into a data structure storing flow identifiers computed at said respective router interface during said time window; c) storing said data structure in a searchable repository at said network node; d) repeating steps a) to c) for a plurality of successive time windows, wherein each router interface stores a separate data structure for each time window; e) determining an arrival time window including a time of arrival of said single malicious packet at said network node, and computing a flow identifier for said single malicious packet; and f) identifying said router interface for said single malicious packet by searching for the flow identifier of said single malicious packet in all data structures stored at said network node that contain data for said arrival time window.