Mitigation of DDoS Attackona Primary Server by Varying Idle and Hard Timeout

Abstract

SDN is a new network architecture, which provides a lot of advantages over traditional networks. One limitation of SDN is the limited flow table size. Many entries in the flow table of the switch result in its exhaustion and affect the performance of the network. In this paper, we show how an intruder can make use of this flow table size limitation to instigate a DDoS attack on the primary server in the network. This is done by compromising a host that is connected to the same switch as that of the primary server to flood packets to different destination IP addresses. Doing so will result in the controller installing many unwanted rules onto the switch to handle this traffic resulting in delayed responses from the primary server to its genuine clients. We further propose a solution to identify such attacks using a module running on the controller that differentiates between genuine traffic and attack traffic and installs the flow table rules with varying idle and hard timeout values to mitigate the attack.