# Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
## 5 Results
### Single-LAN Scenario  
In the network design used in the previous scenario, there was an imbalance between the computational and network resources of the devices deployed at both levels. Specifically, the router located at the core level had fewer resources than the switches located at the access level. Therefore, in this scenario, a more balanced design is used, where mitigation strategies are applied at the aggregation and access levels using devices with similar characteristics. The objective is to determine whether the same behaviour is observed in this scenario as in the previous one. The average CPU usage by the network devices as the aggregated malicious traffic increases is shown in Figure 10. The CPU usage in this scenario is always higher at the access level than at the aggregation level. This is due to the exchange of background multicast traffic since the access level switches transmit a greater number of multicast flows than the aggregation level switch. As can be seen in Figure 10a, there is slightly higher CPU usage at the aggregation level when the mitigation strategy is ACL-based. This is because the switch deployed  
Figure 10: CPU usage on Single-LAN scenario. Figure 9: Power consumption on Multiple-LAN scenario. at that level must process all the malicious traffic. When the mitigation strategy used is SDN-based, the CPU usage decreases at the aggregation level and moves to the access level as shown in Figure 9(b). The two switches suffer an increase in CPU usage due to traffic analysis on the flow table. Therefore, these results again demonstrate how the workload moves between levels depending on the mitigation strategy deployed. Figure 11 shows the average memory consumption by the network devices depending on the mitigation strategy used. As in the previous scenario, memory consumption is hardly affected by the increment of malicious traffic between tests. As observed in the figure, the memory consumption in both levels is slightly higher when the mitigation strategy is based on SDNs. However, the difference between approaches can be considered negligible. Figure 12 shows the average round-trip delay time of a PING from a legitimate user to the gateway as malicious traffic increases using both mitigation strategies. As can be seen, neither of the mitigation strategies has a better impact on latency, which varies from 2.3 to 2.5 ms, with no significant difference between the ACL-based and the SDN-based approach. In addition, there was no packet loss in either approach during the tests, as this scenario does not come close to overloading the switches. Finally, the average power consumption for each mitigation strategy is shown in Figure 13. As can be seen, there is no significant difference at either level, regardless of the mitigation strategy used. Figure 11: Memory consumption on Single-LAN scenario. Figure 12: Legitimate user round-trip delay time. Worst-Case Scenario: Faulty ACL Configuration  
The two scenarios used during the experimentation are examples of oversubscribed networks. In the multiple-LAN scenario, the access switches have more bandwidth available in their downlinks than in their uplinks, while in the single-LAN scenario, the same is true for the aggregation switch. This oversubscribed network design, combined with an ACL configured in outbound mode, may lead to inefficient performance due to a bottleneck. This issue is described and evaluated using the single-LAN scenario since the traffic, both legitimate and malicious, coming from the downlinks of the aggregation switch to the router is significantly higher than in the multiple-LAN scenario. An outbound ACL analyses traffic after it has been routed/commuted. Packets are processed through the outbound ACL after being sent to the outbound interface. This approach is useful when the same criteria must be applied to the traffic received in multiple interfaces whose destination is the same outbound interface. In the single-LAN scenario, there were two trunk ports configured the in 10 Gbps interfaces of the aggregation switch.