1. Network Anti-Spoofing with SDN Data plane Authors:Yehuda Afek et al.
Presenter : Soorya Ravichandran

2. Flow-table rules and Switch-controller messages.
Introduction
Traditional Middle box for anti-spoofing mitigation  CAPEX, Latency and Complexity.
Anti-DDOS system with SDN  Implementing mitigations for both SDN and underlaying infrastructure.
Flow-table rules and Switch-controller messages.

3. Technologies Used OpenFLow 1.5 and P4
P4 for flexible programming of the any protocol header.
Open Vswitch
Hping 3 tool  For generating SYN flood attack.

4. OVerVIew OF SDN
Software Defined Networking  Segregation of Control and Data Plane.
OpenFlow The interface between the Control Plane and Forwarding Plane is done through Open Flow
Match and Action frame work.  Single Match Table (SMT), Multi Match Table (MMT), Reconfigurable Match Table (RMT – Used in this Paper)

5. Problems and SoLutions
DDOS using Spoofed SYN attack.
Statefull and Control Plane saturation attack in SDN controller.
Flow-state congestion
Solutions :
Anti-Sync Spoofing.
State –less challenge response.
Distributed Network Solution.

6. Anti-Sync Spoofing Exhaustion of TCP on server and SDN Flow-table.
Sync Cookie method
HTTP Redirect with same server address.
TCP reset

7. SYNC Cookie Method

8. Generation OF Cookie Controller Communication for Cookie Generation.
Random + SYNC packet parameters
Parameters used = source IP + Source PORT + 32 bit random number
8 bit portion spanned periodically.

9. Distributed Network Solution
Flow table exhaustion due to increased legitimate traffic pin holes.
Vertical Distribution  Resources of Switches are utilised along the bottleneck traffic path.
Table for Space Di for path Pi for each switch.
Threshold level is 80% of rules capacity and processing power.
All switches involving in a saturated path are involved for load balancing.

10. Anti-Spoofing Performance
Without mitigation –Http request fails at 2.7k pps
With mitigation Successful rate is upto 206kpps
Throughput decreases as the mitigation actions are implemented.

11. Anti-Spoofing Performance - cntd

12. Criticism Open vSwitch Security Vulnerability to be taken care
 Buffer Over read Vulnerability.
Open Flow Bypass Vulnerability : bypass of actions in pinholes
Execute Code Open Flow Vulnerability : Allows unauth attacker to execute code
Time stamp consideration in cookie generation.