# Implementation of a Lossless Moving Target Defense Mechanism
## 6 Implementation
### Lossless Dynamic IP Address Mutation Algorithms
The operation mirrors that of the <local, local> case, albeit with different flow tables. Figure 9: Packet processing algorithm in an border switch. ```
Data: headers struct, standardmetadata struct Result: output packet \(match\_key\leftarrow(headers.IPv4.src\_addr); ifborder\(LamPortSrcTable.apply(match\_key)==action\_PacketFromLamPort()\)then \(match\_key\leftarrow(headers.IPv4.dest\_address); ifborder\(LamStTable.apply(match\_key)==action\_PacketToLamPort()\)then \(match\_key\leftarrow(headers.IPv4.dst\_addr); ifborder\(LamPortDistTable.apply(match\_key)\)then  Set destination port based on action parameters; else  Mark packet to drop;  end if else \(match\_keyA\leftarrow(headers.IPv4.dst\_addr,current_{IP}\_version); match\_keyB\leftarrow(headers.IPv4.src\_addr,current_{IP}\_version);  Translate destination IP address and set output port number according to \(action\_TranslateDistAddress()\) executed by \(borderTranslationDistTable.apply(match\_keyA)\);  Translate source IP address according to \(action\_TranslateSrcAddress()\) executed by \(borderTranslationSrcTable.apply(match\_keyB)\)  end if else \(match\_key\leftarrow(headers.IPv4.src\_addr);  Get \(IP\_address\_version\) from \(action\_PacketFromLamPort()\) executed by \(borderLamPortSrcTable.apply(match\_key)\); ifIP\(address\_version>current\_IP\_version\)then \(current\_IP\_version\gets IP\_address\_version\);  end if \(match\_keyA\leftarrow(headers.IPv4.dst\_addr,current\_IP\_version); match\_keyB\leftarrow(headers.IPv4.src\_addr,current\_IP\_version);  Translate destination IP address and set output port number according to \(action\_TranslateDistToLamAddress()\) executed by \(borderTranslationDistToLamTable.apply(match\_keyA)\);  Translate source IP address according to \(action\_TranslateSrcToLamAddress()\) executed by \(borderTranslationSrcToLamTable.apply(match\_keyB)\)  end if if Packet is not marked to dropthen  Emit Packet else  Drop Packet end
```  
**Algorithm 2**Packet processing algorithm in border switch. Implementing the proposed mechanism in traditional computer networks is practically impossible. Routers make packet routing decisions based on the entries in the routing table, the contents of which are supplied by specific routing protocols. Changing the contents of routing tables is possible, for example, by using static entries that would be supplied through the Representational State Transfer Configuration (RESTCONF) protocol [57]. However, such a procedure would be quite time consuming. This means that services provided by networks would be temporarily unavailable for a certain period, which, in modern networks with throughput expressed in tens of GB/s, is unacceptable. Moreover, changing the IP addresses of router interfaces forces the change in addresses for all hosts connected to the router (directly or via layer 2 switches). This requirement could be addressed by using the DHCP protocol. However, introducing another traditional mechanism would further extend the service unavailability. Even using NAT functions would not solve the problem due to functional limitations (changing IP addresses affects existing TCP sessions, problems with UDP protocol handling, the need for port forwarding). Implementing such a solution in a traditional computer network, from the network administrator's perspective, would be an unimaginable endeavor.