Distributed Denial of Service (DDoS) attacks are the major threat to the current internet world. Source IP Address spoofing is one of the approach to perform Distributed Denial of Service (DDoS) attacks. In this scenario the packet true origin is difficult to identify. Thus the defense against the Distributed Denial of Service (DDoS) attack is very complex to handle. We propose a novel scheme which is based on a firewall. This firewall can distinguish the attack packets from the packets sent by legitimate users based on the marking value on the packet, and thus filter out most of the attack packets. Compared to other packet-marking based solutions, our scheme is very effective and has a very low deployment cost. In the implementation of this scheme we would require the cooperation of only about 10% of the Internet routers in the marking process, and server to generate encrypted marking for secured transmission. The scheme allows the firewall to Detected a

1. A. Belenky and N. Ansari, “IP traceback with deterministic packet marking” IEEE Communications Letters, vol. 7, no. 4, pp. 162–164, Apr. 2003.
2. A. Yaar, A. Perrig, and D. Song, “Pi: A path identification mechanism to defend against DDoS attacks” in Proceedings of the IEEE Symposium on Security and Privacy, pp. 93–109, May 2003.
3. D. Dean, M. Franklin, and A. Stubblefield, “An algebraic approach to IP trackback” in Proceedings of the 2001 Network and Distributed System Security Symposioum, pp. 3–12, Feb. 2001.

Distributed denial of service attack firewalls IP address spoofing Packet filtering Encryption