# Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
## 5 Results
### Multiple-LAN Scenario  
Figure 6 shows the average CPU usage by the network devices as the aggregated malicious traffic increases. As observed in Figure 6a, the CPU usage grows faster at the core level as the ACL configured in the router processes more traffic. When the aggregate malicious traffic reaches 90 Mbps, CPU usage peaks and stabilises at around 50%. This means that the router begins to discard traffic when exceeding 90 Mbps without processing it. Figure 6a also shows how the CPU usage in the core level is much lower, remaining constantly at around 7%, when the mitigation strategy is based on SDNs, since the malicious traffic is detected and blocked by the switches located at the access level. Figure 6b shows the CPU usage by the switches. As can be seen, the CPU usage slightly increases when the mitigation strategy is based on SDNs, since the switches assume extra workload. These plots demonstrate how the workload moves from one level to another according to the mitigation strategy deployed in the scenario. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Setting** & **Multiple-LAN Scenario** & **Single-LAN Scenario** \\ \hline Test duration & 300 s & 300 s \\ \hline Number of repetitions & 3 & 3 \\ \hline Device with ACL configured & Router & Switch (S2) \\ \hline Device with Flow Table configured & Switches (\(S1\), S2, S3) & Switches (\(S1\), \(S3\)) \\ \hline Background multicast traffic & 8 Gbps & 8 Gbps \\ \hline Background legitimate traffic & 1 Mbps & 10 Mbps \\ \hline Attackers located on each access switch & 1 & 2 \\ \hline Malicious traffic increment & 5 Mbps per attacker & 100 Mbps per attacker \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Experimentation settings. Moreover, the average memory consumption by the network devices using both mitigation strategies is shown in Figure 7. As with the CPU usage, the memory consumption in the router located at the core level is higher when the mitigation strategy is based on ACLs than when it is based on SDNs as shown in Figure 6(a). In contrast, Figure 6(b) shows that the memory consumption in the switches located at the access level is slightly higher with the strategy based on SDNs. However, there is no significant difference when comparing mitigation approaches, since the memory consumption is hardly affected by the increment of malicious traffic between tests. Figure 8 shows how a legitimate user is affected by the implementation of each mitigation strategy. When the strategy is based on ACLs, a PING from a legitimate user to the gateway takes longer as the malicious traffic increases, as can be seen in Figure 7(a). The average round-trip time delay stabilises at 105 Mbps of aggregate malicious traffic. This means that the router begins to discard traffic without processing it. In contrast, the round-trip time delay remains constant when the mitigation strategy is based on SDNs. The results show how each approach affects this scenario. In the case of the ACL-based approach, the filtering of malicious traffic is achieved at the router, whereas in the case of the SDN-based approach, the filtering is performed at the switches. Thus, when using SDNs, malicious traffic is prevented from reaching the router, resulting in a lower RTT. Figure 8: Legitimate user statistics. Figure 6: CPU usage on Multiple-LAN scenario. Figure 7: Memory consumption on Multiple-LAN scenario. Figure 8b shows the average percentage of packets lost when pinging from a legitimate user to the gateway. As discussed for the CPU usage and the round-trip time delay for the ACL-based approach, it can be seen that the router discards packets without processing them starting from 105 Mbps of aggregate malicious traffic, so it does not discriminate between legitimate and malicious traffic. In contrast, no packet loss occurs with the SDN-based approach. These results demonstrate that, in this scenario, using the mitigation strategy based on configuring ACLs at the core level has a more negative impact on legitimate users than using the mitigation strategy based on SDNs.