The virtual postmarks "are intended to occupy obsolete fields in the IP packet headers and are formed from the 32-bit IP addresses of the border router," Hale explained. For IP headers less than 32 bits long, the Penn State researchers propose segmenting the border router's IP address into several overlapping fragments. . . .
The virtual postmarks "are intended to occupy obsolete fields in the IP packet headers and are formed from the 32-bit IP addresses of the border router," Hale explained. For IP headers less than 32 bits long, the Penn State researchers propose segmenting the border router's IP address into several overlapping fragments.

"Each such fragment would be used as a possible mark by the router," Hamadeh said.

Like the forensic investigators who examined the postmarks on the anonymous anthrax packets of 2001, cyber cops can piece together the address fragments of border routers that mark and forward malicious data packets.