  Amplification DDoS attacks inherently rely on IP spoofing to steer attack
traffic to the victim. At the same time, IP spoofing undermines prosecution, as
the originating attack infrastructure remains hidden. Researchers have
therefore proposed various mechanisms to trace back amplification attacks (or
IP-spoofed attacks in general). However, existing traceback techniques require
either the cooperation of external parties or a priori knowledge about the
attacker. We propose BGPeek-a-Boo, a BGP-based approach to trace back
amplification attacks to their origin network. BGPeek-a-Boo monitors
amplification attacks with honeypots and uses BGP poisoning to temporarily shut
down ingress traffic from selected Autonomous Systems. By systematically
probing the entire AS space, we detect systems forwarding and originating
spoofed traffic. We then show how a graph-based model of BGP route propagation
can reduce the search space, resulting in a 5x median speed-up and over 20x for
1/4 of all cases. BGPeek-a-Boo achieves a unique traceback result 60% of the
time in a simulation-based evaluation supported by real-world experiments.
