Slow TCAM Exhaustion DDoS Attack - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2017

Slow TCAM Exhaustion DDoS Attack


Software Defined Networks (SDN) facilitate network management by decoupling the data plane which forwards packets using efficient switches from the control plane by leaving the decisions on how packets should be forwarded to a (centralized) controller. However, due to limitations on the number of forwarding rules a switch can store in its TCAM memory, SDN networks have been subject to saturation and TCAM exhaustion attacks where the attacker is able to deny service by forcing a target switch to install a great number of rules. An underlying assumption is that these attacks are carried out by sending a high rate of unique packets. This paper shows that this assumption is not necessarily true and that SDNs are vulnerable to Slow TCAM exhaustion attacks (Slow-TCAM). We analyse this attack arguing that existing defenses for saturation and TCAM exhaustion attacks are not able to mitigate Slow-TCAM due to its relatively low traffic rate. We then propose a novel defense called SIFT based on selective strategies demonstrating its effectiveness against the Slow-TCAM attack.
Fichier principal
Vignette du fichier
449885_1_En_2_Chapter.pdf (805.07 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01649013 , version 1 (27-11-2017)





Túlio A. Pascoal, Yuri G. Dantas, Iguatemi E. Fonseca, Vivek Nigam. Slow TCAM Exhaustion DDoS Attack. 32th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), May 2017, Rome, Italy. pp.17-31, ⟨10.1007/978-3-319-58469-0_2⟩. ⟨hal-01649013⟩
237 View
171 Download



Gmail Facebook X LinkedIn More