# Implementation of a Lossless Moving Target Defense Mechanism
## 7 Performance Evaluation
### Convergence Time
 \tag{3}\]  
where \(T\bigg{(}I^{S^{B}_{1}}\bigg{)}\) is the time of generating and sending an IP packet from \(S^{B}_{j_{1}}\), while \(T\bigg{(}I^{S^{B}_{2}}\bigg{)}\) is the time of receiving and processing an IP packet in \(S^{B}_{j_{1}}\). The times \(T\bigg{(}L^{C-B}_{i_{1}j_{1}}\bigg{)}\) and \(T\Big{(}L^{C-B}_{i_{2}j_{2}}\Big{)}\) are the propagation times on the links connecting border switches to core switches. The time \(T\big{(}S^{C}_{i}\big{)}\) is the time of receiving the packet, processing it (finding the route for the packet, modifying IP header fields), and sending it to the next switch. The time \(T\Big{(}L^{C-C}_{i_{1}j_{2}}\Big{)}\) is the propagation time between two core switches. Similar to \(T^{Controler}\), we can assume that all active elements are identical, so Formula (3) can be simplified to  
\[ \begin{split} T^{Transfer}&=T\Big{(}I^{S^{B}_{j_{1 }}}\Big{)}+T\bigg{(}I^{S^{B}_{j_{2}}}\bigg{)}+\text{min}\Big{(}T\Big{(}L^{C-B}_ {i_{1}j_{1}}\Big{)}+T\Big{(}L^{C-B}i_{2},j_{2}\Big{)}+\\ &+c\cdot T\Big{(}S^{C}_{i}\Big{)}+\sum T\Big{(}L^{C-C}_{i_{1}j_ {2}}\Big{)}\bigg{)}\end{split}  \tag{4}\]  
where \(c\) is the number of core switches located on the path between two border switches. The signal in a fiber optic link is transmitted at the speed of light (\(3\cdot 10^{8}\) m/s), which means that sending a frame over a distance of 1 km takes 3.3 \(\upmu\)s. Assuming that the protected network is located in a limited area, where the length of links between core switches is similar and does not exceed the length \(DL\) (e.g., 1 km), Formula (4) can be simplified to  
\[ \begin{split} T^{Transfer}&=T\bigg{(}I^{S^{B}_{j_{1 }}}\bigg{)}+T\bigg{(}I^{S^{B}_{j_{2}}}\bigg{)}+\text{min}\Big{(}T\Big{(}L^{C-B} _{i_{1}j_{1}}\Big{)}+T\Big{(}L^{C-B}_{i_{2}j_{2}}\Big{)}+\\ &+c\cdot T\bigg{(}S^{C}_{i}\Big{)}+(c-1)\cdot T(DL)\bigg{)}\end{split}  \tag{5}\]  
Considering all time components, the convergence time in scenario I is calculated as  
\[T^{I}_{\text{convergence}}=T^{Controler}+T^{Transfer} \tag{6}\]  
Scenario II: In this scenario, it is assumed that the SDN controller cannot send information about the change in IP address generation to all switches simultaneously. Instead, the data exchange operation follows a sequential algorithm, where the controller only proceeds to modify the flow tables in the next switch after receiving confirmation of the modification's completion from the currently modified switch. The controller can proceed to modify the flow tables in the next switch only after receiving confirmation of the completion of the modification from the switch currently being modified. According to Algorithm 2, the change in IP address generation, enforced by messages from the SDN controller, can be supplemented by propagating information about the new generation through the exchange of IP packets in the data plane. It is worth noting a potential Scenario III, where the SDN controller informs only one switch about the generation change, and the other switches adjust the generation of IP addresses based on packet exchanges in the data plane. This approach has a significant limitation: if a given edge switch does not receive IP packets with addresses from the new generation--or receives no IP packets at all--it will continue using the previous generation of IP addresses. While using generation propagation in the data plane can speed up the generation change in individual switches, informing all switches through the SDN controller is necessary to achieve a converged state. In such a case, the convergence time in scenario II (denoted as \(T^{II}_{\text{convergence}}\)) is equal to the sum of the message transfer times between the SDN controller and all SDN switches, as well as the longest packet transmission time between two border switches. \(T_{\text{convergence}}^{II}\) is given by  
\[T_{\text{convergence}}^{II}=(c+b)\cdot T^{Controller}+T^{Transfer} \tag{7}\]  
where \(c\) is the number of core switches, and \(b\) is the number of border switches.