# Implementation of a Lossless Moving Target Defense Mechanism
## 6 Implementation
### Lossless Dynamic IP Address Mutation Algorithms  
As mentioned in the previous subsection, the network comprises two types of network elements: core switches and border switches. In the proposed solution, both types of switches implement a different algorithm. For core switches, the algorithm (illustrated in Figure 8 and, as pseudocode, in Algorithm 1) is confined to directing the packet to the appropriate output interface or deleting the packet in the absence of a corresponding entry. Since the entire network is assumed to use IP addresses assigned by the SDN controller, the appearance of a packet directed to an IP address not within the group of addresses assigned to hosts can, at most, activate functions that inform the controller about such an event. It is crucial that before adopting a new generation of IP addresses, the flow tables of all core switches contain all the necessary entries related to that generation. Core switches do not modify packet headers, except for the standard operation of the IP protocol, namely, the decrease in the Time-To-Live (TTL) field. Since this is a standard operation, it is not included in Figure 8 or Algorithm 1. The processing algorithm us presented in two ways, as a diagram and as pseudocode, enabling readers to more easily grasp the operation of the proposed method. While the diagram does not indicate all the keys used in searching the flow tables, it significantly aids in analyzing the algorithm. ```
Data: headers struct, standardmetadata struct Result: output packet \(match\_key\leftarrow(headers\_IPv\_4\_dest\_addr); ifcoreIPv\(4\_Table\_apply(match\_key)==\)\(\textit{accent\_ForwardPacket}()\)then  Set output port based on parameters from \(\textit{accent\_ForwardPacket}()\); else  Mark packet to drop;  end if
```  
**Algorithm 1**Packet processing algorithm in core switch. In the case of border switches, whose algorithms are illustrated in Figure 9 and Algorithm 2, the processing process includes a larger number of conditional instructions. The common step in all paths of the algorithm is determining the input interface and the interface through which the packet must be sent. The number of the input interface is already provided in the parser block as standard metadata. The number of the output interface can only be determined in the ingress match block after searching the appropriate flow table. Input and output interfaces can be categorized into local and core interfaces. Based on the pair <input interface, output interface>, we can identify four packet processing processes:  
* <local, local>: In this mode, the packet is directed to a specific local interface. The only modification that may occur is updating the TTL field and the checksum field of the IP header. Figure 8: Packet processing algorithm in a core switch. * <local, core>: In this scenario, it is necessary to modify both the source and destination IP addresses, which are contained in the respective flow tables. The search involves IP addresses and a value representing the current generation, which can be stored in a separate flow table or register (register is a special type of data in the P4 language, and a variable, uniquely retains a value determined during the processing of the previous packet). * <core, local>: The scenario very similar to the <local, core> case. The modification of the IP addresses to those used in the local network is also required. To find the IP addresses that will replace the IP addresses present in the packet headers, only the IP addresses from the header are utilized. The result of the search also returns the generation of IP addresses. If the searched generation is newer than the current generation, it indicates that the system has started using a new generation. In such a case, modifying the generation table or register and sending a message to the SDN controller once is necessary. * <core, core>: This scenario, not included in the diagrams to avoid further expanding them, is possible to implement.