Amplified Distributed Denial of Service Attack in Software Defined Networking

Software Defined Networking (SDN) is an alternative networking paradigm that provides flexible network management through the separation between data plane and control plane functionalities. This separation results in extensive communication between control and data plane, which can result in a severe bottleneck for the whole network, under high traffic conditions. Moreover, researchers shown that an adversary can exploit this bottleneck to mount a powerful Denial of Service attack on the control plane, known as Control Plane Saturation Attack (CPSA). In this paper, we provide a thorough analysis of the CPSA, and in particular we show how it can be amplified by long forwarding paths in an SDN network. We prove the effectiveness of the attack through extensive testing using OpenFlow, the most widely adopted control-data plane communication protocol for SDN. Our evaluation shows that, when the forwarding path length in increased by 5 times, the attacker can leverage a 55% decrease in the attack rate required to incapacitate the network.