a method for tracing packets in a communications network directed to tracing a stream of anonymous packets received at a given target host , in order to identify their source , in response , for example , to a denial - of - service attack on the target host . advantageously , the tracing is performed without reliance on knowledge or cooperation from intervening internet service providers along the path . the method is performed by applying a “ burst load ” to various elements in the network and measuring the change in the rate with which the stream of packets arrive at the target . if the rate is substantially altered upon introduction of the burst load , then it may be deduced that the given element is most likely on the path from the source host of the dos attack to the target host .