Distributed denial of service (DDoS) is a rapidly growing problem. The multitude and variety of attacks and defensive approaches are overwhelming. IP tracing, the ability to trace IP packets from source to destination, is a significant step toward identifying and thus arresting attackers. IP tracing is an important mechanism for defending against distributed denial of service (DDoS) attacks. This document builds a simulation environment by expanding ns2, establishing topology and attack traffic, which can be used to evaluate and compare the effectiveness of different crawl schemes. A comparison of some of the packet-dialing schemes is presented with several metrics, including the received packet number required to reconstruct the attack path, the calculation complexity, and the false-positive, etc. The simulation approach can also be used to test the execution effects of different tagging schemes on large-scale DDoS attacks. Based on the results of simulation and evaluation, more efficient algorithms, techniques and procedures can be developed to combat these attacks.