We present a hash-based technique for IP traceback that generates
audit trails for traffic at network routers enabling the trace of a
single IP packet delivered by the network in the recent past.  This
talk examines the storage costs at each router and demonstrates that
the system produces effective results using as little as 0.5% of a
router's total link capacity per unit time in storage.

Packet traceback is complicated when packets are transformed or
modified inside the network.  We discuss the issues raised by packet
transforms and present techniques for addressing them in our
hash-based approach.  The talk concludes with an extension to the
initial scheme that allows packet auditing and traceback in devices
external to the routers.