Provided is a method for tracing-back an IP using marking information of a router stored on a hop-by-hop option header, which is one of IPv6 extension headers. According to the method, an attack made by an attacker is detected on the IPv6 network. If the attack is detected, information stored on a hop-by-hop option header of a packet received through the IPv6 network and marked by a router through which the packet has passed is extracted. After that, a reception path of the received packet is reconstructed and an IP of the attacker is back-traced using the extracted marking information.