# Flow Table Saturation Attack against Dynamic Timeout Mechanisms in SDN
## 3 Typical Flow Table Saturation Attack
### Case Studies--Adaptive Timeout  
In this case study, the controller adopts adaptive timeout mechanisms. Although different configurations (e.g., random timeouts) are discussed as possible countermeasures against the inferring-based attack [10], it is a more practical implementation for adaptive timeout mechanisms in practice. We show that the existing attack can fail in this situation. In past few years, many studies [16; 21] have proposed to assign adaptive timeout for flow rules. This mechanism assigns timeout values covering expected packet intervals, in an effort to reduce the flow table occupation and the number of table-misses. Note that the main purpose of this method is to reduce flow table occupancy under benign conditions. To achieve a quick response, the logic of timeout calculation is always straightforward. We summarize the basic idea of adaptive timeout mechanisms and present it in Figure 3. Here, \(T_{init}\) is the initial value for new flows, \(T_{max}\) is the maximum timeout to avoid infinite growth, \(interval\_threshold\) is a constant number to avoid assigning large timeouts for repeated short flows, and \"_Interval_\" represents the time interval between the current packet-in and the last Flow-Removed event. We use a case to illustrate how the typical flow table saturation attack fails when facing the adaptive timeout strategy. In this case, we set \(T_{init}\) to 1 s, the \(interval\_threshold\) value to 5 s, and the \(T_{max}\) to 10 s. Now, we try to probe the timeout values with the incremental search and binary search methods mentioned above. We depict the result in Figure 4. The blue arrow indicates that the probing packet is matched, while the red one means that it is unmatched by flow entries, and the attacker observes a higher RTT. The new timeout value set by the controller is marked above the arrow. In Figure 4a, the incremental search method returns a minimal value. This is because the third probing packet, which is sent 2 s after the previous one, triggers the first table-miss after the rule installation. Therefore, the probing procedure falsely reports the timeout value is 1 s, which is actually the value of \(T_{init}\). If the packet interval in the following attacking phase is such a small value, the attack cost can be very high. According to the calculation in [10], the attacker must generate attack traffic with a rate of at least 1000 pps to overflow the flow table with a capacity of 1000. Figure 2: Examples of probing timeouts using incremental search and binary search in the fixed timeout scenario: (**a**) incremental search; (**b**) binary search. As for the binary search method, it obtains a different result. The process is shown in Figure 4. Since the fourth packet, with 4 s as the inter-arrival time, is not matched, while the last one, with 3 s can be matched, we infer the timeout value as 3 s, which is far less than the maximum setting (i.e., 10 s in this case). In the next attack phase, the packet intervals of attack flows should be within 3 s. So, the required attack traffic rate to overflow the flow table is still much higher than where flow rules are assigned with the maximum value. Moreover, the probed result may inadvertently reveal the attacker's presence. Based on the inferred results, the attacker may believe that the controller sets flow rules with a timeout value of 3 s for the attack flow. However, the first packet actually only generates the flow rule with the initial timeout value, which expires after 1 s due to the packet interval being 3 s. The flow rule is only reinstalled and assigned with 3 s when the second packet arrives. From the perspective of the SDN controller, it always receives two successive packet-in messages with the same time intervals and assigns the same timeout for all attack flows. In other words, attack flows exhibit similarity in the interval of the first two packet-in events and the assigned timeout, which can be captured as a notable feature for identifying abnormal flows.