Routing infrastructure plays a vital mle in the Internet, and attacks on routers can be damaging. Compromised routers can drop, modih, mislforward or reorder valid packets. Existing proposals for secure forwarding require substantial computational overhead and additional capabilities at routers. We propose Secure Split Assignment Trajectory Sampling (SATS), a system that detects malicious routers on the data plane. SATS locates a set of suspicious routers when packets do not follow their predicted paths. It works with a traffic measurement platform using packet sampling, has low overhead on routers and is applicable to high-speed networks. Different subsets ofpackets are sampled over dzyerent groups of routers to ensure that an attacker cannot completely evade detection. Our evaluation shows that SATS can signzjicantly limit a malicious router's harm to a small portion of traffic in a network.