# Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
## 3 Related Work  
Several research works have been published aiming to improve the deployment of conventional network segmentation solutions. In [20], the authors present _the simple-set-based_ algorithm, a mathematical solution that creates an efficient VLAN network structure by analysing traffic flows and defining which VLAN is the most suitable for each node of the network. Another VLAN segmentation approach is proposed in [21] to adequately separate voice and data packets in Voice-over-IP (VoIP) networks to improve network security. Although the use of VLANs is a widespread solution in conventional corporate networks, it poses some disadvantages such as a more complex network addressing design and the potential presence of vulnerable VLAN-related protocols such as Dynamic Trunk Protocol (DTP), VLAN Trunking Protocol (VTP), or Generic VLAN Registration Protocol (GVRP). To overcome some of these drawbacks, PVLANs have been used as an alternative in order to secure and optimise layer 2 communications both in industrial [22] and corporate networks [23]. In addition, PVLANs have been proposed as an effective network isolation technique to protect IoT environments [24]. Nowadays, PVLANs are mainly used by Internet Service Providers (ISPs) to avoid communications between different customers within the same LAN segment, in business parks where companies share the same public IP address space, and in shared hosting sites [25]. Leaving the security component aside, PVLANs together with SDNs have also been used in cloud computing environments to simulate link aggregation to enhance performance. For example, PVLAN promiscuous ports are combined as a single logical port to optimise load balancing and path selection [26]. Although the SDN paradigm cannot be directly extrapolated to conventional corporate networks, its goals and some of its fundamentals can. In fact, as an SDN can be programmed to detect anomalous traffic and subsequently modify the network behaviour, there is extensive related work focused on the detection of potentially dangerous traffic and the mitigation of the risks associated with it. A solution to detect and mitigate Address Resolution Protocol (ARP) spoofing and ARP poisoning attacks are described in [27]. An SDN security module designed to stop ARP Spoofing attacks within corporate networks with minimal intervention from network administrators is presented in [28]. A similar solution tailored to cloud-fog-edge platforms can be found in [29]. In addition, a solution to mitigate Dynamic Host Configuration Protocol (DHCP) starvation and DHCP spoofing attacks is described in [30]. Finally, there are other interesting works focused on protecting the network from other less common attacks such as flooding attacks through ARP storming [31] and Neighbor Discovery Protocol (NDP) spoofing [32]. Recently, a large number of research works have been published focused on performing comparative analyses on SDNs and conventional networks. These works evaluate several aspects such as routing protocols [16; 17], control plane security [33], and delay [34; 35], among others. Regarding PVLANs, a comparison between an SDN-based model and a conventional network is presented in [36], where the deployment of VLAN and PVLAN filtering and segmentation using both approaches is analysed. The authors state that the conventional approach can be difficult to configure in large network environments, which implies a higher deployment cost. They also conclude that an SDN solution is easier to implement, as the intelligence is centralised in the SDN controller. However, they do not carry out a performance evaluation of both approaches. In this work, a corporate networking scenario using PVLANs is emulated, and different mitigation strategies are evaluated in order to carry out a performance comparative analysis on the use of resources of both strategies.