Abstract: An ideal model and its extended model of attack path reconstruction for IP traceback were established. Based on the method of probabilistic packet marking, attack path reconstructing process could be described as a convergent stochastic process, and the quantitative relationship of convergence time, path length and marking probability was presented. The required condition to obtain minimum convergence time was derived. The simulation results show that experimental values coincide with the theory results very well. The model provides a theoretic foundation for further research work on probabilistic packet marking approach.