The DOI matches its Crossref record; 29 of the 29 references it cites were found in a registry or an index.
Hop-count filtering: an effective defense against spoofed DDoS traffic
Abstract
IP spoofing has been exploited by Distributed Denial of Service (DDoS) attacks to (1) conceal flooding sources and localities in flooding traffic, and (2) coax legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victims is essential to their own protection as well as to their avoidance of becoming involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he or she cannot falsify the number of hops an IP packet takes to reach its destination. This hop-count information can be inferred from the Time-to-Live (TTL) value in the IP header. Using a mapping between IP addresses and their hop-counts to an Internet server, the server can distinguish spoofed IP packets from legitimate ones. Base on this observation, we present a novel filtering technique that is immediately deployable to weed out spoofed IP packets. Through analysis using network measurement data, we show that Hop-Count Filtering (HCF) can identify close to 90% of spoofed IP packets, and then discard them with little collateral damage. We implement and evaluate HCF in the Linux kernel, demonstrating its benefits using experimental measurements.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Ferguson, P., & Senie, D. (2000) · doi:10.17487/rfc2827 · Cited by 1,313
Measuring ISP topologies with rocketfuel
Spring, N., Mahajan, R., & Wetherall, D. (2002) · Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/633025.633039 · Cited by 1,256
Practical network support for IP traceback
Savage, S., Wetherall, D., Karlin, A., & Anderson, T. (2000) · ACM SIGCOMM Computer Communication Review · doi:10.1145/347057.347560 · Cited by 1,127
(2011) · doi:10.1109/infocom17876.2011 · Cited by 1,058
Measuring ISP Topologies With Rocketfuel
Spring, N., Mahajan, R., Wetherall, D., & Anderson, T. (2004) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2003.822655 · Cited by 1,010
Inferring Internet Denial-of-Service Activity
Moore, D., Voelker, G. M., & Savage, S. (2001) · doi:10.21236/ada400003 · Cited by 863
Advanced and authenticated marking schemes for IP traceback
Song, D. X., & Perrig, A. (2002) · Proceedings IEEE INFOCOM 2001. Conference on Computer Communications. Twentieth Annual Joint Conference of the IEEE Computer and Communications Society (Cat. No.01CH37213) · doi:10.1109/infcom.2001.916279 · Cited by 750
Controlling high bandwidth aggregates in the network
Mahajan, R., Bellovin, S. M., Floyd, S., Ioannidis, J., Paxson, V., & Shenker, S. (2002) · ACM SIGCOMM Computer Communication Review · doi:10.1145/571697.571724 · Cited by 742
Snoeren, A. C., Partridge, C., Sanchez, L. A., Jones, C. E., Tchakountio, F., Kent, S. T., & Strayer, W. T. (2001) · Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/383059.383060 · Cited by 733
End-to-end routing behavior in the Internet
Paxson, V. (1997) · IEEE/ACM Transactions on Networking · doi:10.1109/90.649563 · Cited by 698
Cited by
Akamai DNS: Providing Authoritative Answers to the World's Queries
Schomp, K., Bhardwaj, O., Kurdoglu, E., Muhaimen, M., & Sitaraman, R. K. (2020) · Proceedings of the Annual conference of the ACM Special Interest Group on Data Communication on the applications, technologies, architectures, and protocols for computer communication · doi:10.1145/3387514.3405881 · Cited by 38
PREVIR: Fortifying Vehicular Networks Against Denial of Service Attacks
Verma, A., Saha, R., Kumar, G., Conti, M., & Kim, T.-H. (2024) · IEEE Access · doi:10.1109/access.2024.3382992 · Cited by 11
Metadata
- Authors
- Jin, C., Wang, H., & Shin, K. G.
- Venue
- Proceedings of the 10th ACM conference on Computer and communications security
- Publisher
- ACM
- Published
- 2003-10-27
- Pages
- 30-41
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2001968297
- Cited by
- 468
- References
- 29
- FWCI
- 16.44
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Hop-count filtering: an effective defense against spoofed DDoS traffic. https://app.cochat.ai/papers/10.1145/948109.948116
- The paper
- Jin, C., Wang, H., & Shin, K. G. (2003). Hop-count filtering: an effective defense against spoofed DDoS traffic. Proceedings of the 10th ACM conference on Computer and communications security. https://doi.org/10.1145/948109.948116
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
