According to the trace analysis, the real attacker could be found.If this idea is applied in the intrusion detection, the network resistibility under IP spoofing will be reinforced.