SYN Flood Attack Detection and Mitigation with P4 Programmable Switches
Learn about detecting and mitigating SYN flood attacks using P4 programmable switches. Understand the concept of SYN flood attacks, how they overload servers, and how P4 can help detect and drop malicious SYN packets to protect against such attacks effectively.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Security Apps with P4 Programmable Switches Detecting and mitigating SYN flood attacks in P4 Ali AlSabeh, Jorge Crichigno University of South Carolina http://ce.sc.edu/cyberinfra University of South Carolina (USC) Energy Sciences Network (ESnet) September 18, 2023 1
SYN Flood Attack Massive amount of TCP SYN requests with spoofed IP addresses are sent to the server These connections consume the server s resources, making it unresponsive to legitimate traffic Server start half-open connections Connections build up until queue is full and all additional requests are blocked SYN packets Attack machine Target server 2
SYN Flood Detection in P4 Count the number of SYN packets per second in the data plane When the count exceeds a predefined threshold, the switch starts dropping SYN packets The dropping percentage is configured by the administrator from the control plane 3
SYN Flood Detection in P4 Assuming that the attacker is generating 900 SYN packets per second The SYN count detection threshold is 100 packets per second Assume that the drop percentage is 50% The number of packets that will be forwarded is: 100 + (900 100) 50/100 = 100 + 800 2 = 500 1 500 1 900 Victim Attacker SYN packets threshold: 100 Dropping percentage: 50% 4
