Simulation environments and approaches for evaluating real-time of IP traceback in different network scenarios and attacking patterns are very important. A comparison among some of the most promising PPM (Probabilistic Packet Marking) schemes is presented with several metrics, including the received packet number required for reconstructing the attacking path, computation complexity and false positive etc. We constructe a simulation environment via extending ns2, setting attacking topology and traffic, which can be used to evaluate and compare the effectiveness of different PPM schemes. The simulation approach also can be used to test the performing effects of different PPM schemes in large-scale DDoS attacks. Based on the simulation and evaluation results, several improvable aspects of PPM are proposed, which can increase real-time of IP traceback efficiently.