Skip to Main content Skip to Navigation
Conference papers

Slow TCAM Exhaustion DDoS Attack

Abstract : Software Defined Networks (SDN) facilitate network management by decoupling the data plane which forwards packets using efficient switches from the control plane by leaving the decisions on how packets should be forwarded to a (centralized) controller. However, due to limitations on the number of forwarding rules a switch can store in its TCAM memory, SDN networks have been subject to saturation and TCAM exhaustion attacks where the attacker is able to deny service by forcing a target switch to install a great number of rules. An underlying assumption is that these attacks are carried out by sending a high rate of unique packets. This paper shows that this assumption is not necessarily true and that SDNs are vulnerable to Slow TCAM exhaustion attacks (Slow-TCAM). We analyse this attack arguing that existing defenses for saturation and TCAM exhaustion attacks are not able to mitigate Slow-TCAM due to its relatively low traffic rate. We then propose a novel defense called SIFT based on selective strategies demonstrating its effectiveness against the Slow-TCAM attack.
Document type :
Conference papers
Complete list of metadata

Cited literature [27 references]  Display  Hide  Download
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Monday, November 27, 2017 - 10:32:07 AM
Last modification on : Wednesday, August 28, 2019 - 3:08:04 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Túlio Pascoal, Yuri Dantas, Iguatemi Fonseca, Vivek Nigam. Slow TCAM Exhaustion DDoS Attack. 32th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), May 2017, Rome, Italy. pp.17-31, ⟨10.1007/978-3-319-58469-0_2⟩. ⟨hal-01649013⟩



Les métriques sont temporairement indisponibles