## 4 Simulation and Experimental Results
### Simulation Results  
From the DDoS attack simulations carried out in the different scenarios, significant slowdowns were recorded as the attacks increased, even going as far as the fall of a controller in the last scenario. All the results were obtained by capturing the network traffic via Wireshark. In particular, we captured the TCP traffic between the client and the server to observe how the service degraded between the two, focusing majorly on the QoS and QoE policies. For instance, we measured the quality of the channel, showing the throughput and the average Round Trip Time (RTT).  
The first simulation was the attack outside the client-server path, with H7 attacking H10. In Figure 4, we see how the network degraded after the attacks started, even if it was not really significant. The average throughput was 2.02 Mbit/s.  
For the attack where H9 attacked H3, the result was very similar, as shown in Figure 5. Even if the attack crossed the client-server path, the decrease in the throughput was modest. The average throughput was 2.49 Mbit/s.  
The next scenario involved two host attacks. Figure 6 shows that if we attacked two hosts of the same switch, the results improved in the sense that the networks degraded a little bit more but not significantly. In particular, the attack started from H9 and H10 and targeted H3 and H4. The average throughput was 1.92 Mbit/s.  
We then conducted another simulation attacking two hosts, with H8 targeting H2 and H5, H2 being under the same switch as the client, and H5 as the server. In Figure 7, the results show a more degraded communication compared with the other two-host attacks. The average throughput was 1.73 Mbit/s.  
Finally, we conducted a four-host attack, with H7 targeting H2, H3, H5, and H10. As shown in Figure 8, this attack was clearly the most powerful, and communication between the client and server was very compromised. The average throughput was 1.44 Mbit/s.  
Figure 4: Service channel throughput during H7’s attack of H10.  
Figure 5: Service channel throughput during H9’s attack of H3.  
Lastly, Figure 9 shows the average Round Trip Time (RTT) observed in the service channel for all attack scenarios. Similar to the throughput analysis, the average RTT was lower when we increased the number of involved nodes during the attacks. A lower RTT is crucial for latency-sensitive applications, especially in the I4.0 context. The analysis of the packet traces that we collected unveiled that we also observed many more retransmission timeouts (RTOs), which made the delays significantly longer for retransmitting lost packets.  
As shown in Figure 9, the average RTT recorded in the observed time window was around 30 ms for all scenarios. Moreover, as discussed above, most time-sensitive applications in the I4.0 context have a strict cycle time nearly in the range of 1 ms [59]. What we observed was an increase in the average RTT due to a large number of packets that passed through the switches. This behavior can seriously compromise delicate tasks such as remote-control motion, which can endanger workers' lives when working on a farm. Finally, we referred interested readers wanting further experimental results on, for instance, scalability and reliability to the SIRDAM4.0 paper [11], where they can find more details and experimental results about the ongoing implementation.  
Figure 6: Service channel throughput during H9 and H10’s attack of H3 and H4.  
Figure 7: Service channel throughput during H8’s attack of H2 and H5.