ONOS traffic analytics describes how to run the ONOS SDN controller with a virtual network created using Mininet. The article also showed how to monitor network traffic using industry standard sFlow instrumentation available in Mininet and in
physical switches.
This article uses the same ONOS / Mininet test bed to demonstrate how
sFlow-RT real-time flow analytics can be used to push controls to the network through the
ONOS REST API.
Leaf and spine traffic engineering using segment routing and SDN used real-time flow analytics to load balance an ONOS controlled physical network. In this example, we will use ONOS to filter
DDoS attack traffic on a Mininet virtual network.
The following sFlow-RT script,
ddos.js, detects DDoS attacks and programs ONOS filter rules to block the attacks:
var user = 'onos';
var password = 'rocks';
var onos = '192.168.123.1';
var controls = {};
setFlow('udp_reflection',
{keys:'ipdestination,udpsourceport',value:'frames'});
setThreshold('udp_reflection_attack',
{metric:'udp_reflection',value:100,byFlow:true,timeout:2});
setEventHandler(function(evt) {
// don't consider inter-switch links
var link = topologyInterfaceToLink(evt.agent,evt.dataSource);
if(link) return;
// get port information
var port = topologyInterfaceToPort(evt.agent,evt.dataSource);
if(!port) return;
// need OpenFlow info to create ONOS filtering rule
if(!port.dpid || !port.ofport) return;
// we already have a control for this flow
if(controls[evt.flowKey]) return;
var [ipdestination,udpsourceport] = evt.flowKey.split(',');
var msg = {
flows: [
{
priority:4000,
timeout:0,
isPermanent:true,
deviceId:'of:'+port.dpid,
treatment:[],
selector: {
criteria: [
{type:'IN_PORT',port:port.ofport},
{type:'ETH_TYPE',ethType:'0x800'},
{type:'IPV4_DST',ip:ipdestination+'/32'},
{type:'IP_PROTO',protocol:'17'},
{type:'UDP_SRC',udpPort:udpsourceport}
]
}
}
]
};
var resp = http2({
url:'http://'+onos+':8181/onos/v1/flows?appId=ddos',
headers:{'Content-Type':'application/json','Accept':'application/json'},
operation:'post',
user:user,
password:password,
body: JSON.stringify(msg)
});
var {deviceId,flowId} = JSON.parse(resp.body).flows[0];
controls[evt.flowKey] = {
time:Date.now(),
threshold:evt.thresholdID,
agent:evt.agent,
metric:evt.dataSource+'.'+evt.metric,
deviceId:deviceId,
flowId:flowId
};
logInfo("blocking " + evt.flowKey);
},['udp_reflection_attack']);
setIntervalHandler(function() {
var now = Date.now();
for(var key in controls) {
let rec = controls[key];
// keep control for at least 10 seconds
if(now - rec.time < 10000) continue;
// keep control if threshold still triggered
if(thresholdTriggered(rec.threshold,rec.agent,rec.metric,key)) continue;
var resp = http2({
url:'http://'+onos+':8181/onos/v1/flows/'
+encodeURIComponent(rec.deviceId)+'/'+encodeURIComponent(rec.flowId),
headers:{'Accept':'application/json'},
operation:'delete',
user:user,
password:password
});
delete controls[key];
logInfo("unblocking " + key);
}
});
Some notes on the script:
- The ONOS REST API is used to add/remove filters that block the DDoS traffic.
- The controller address, 192.168.123.1, can be found on the ONOS Cluster Nodes web page.
- The udp_reflection flow definition is designed to detect UDP amplification attacks, e.g. DNS amplification attacks
- Controls are applied to the switch port where traffic enters the network
- The controls structure is used to keep track of state associated with deployed configuration changes so that they can be undone
- The intervalHandler() function is used to automatically release controls after 10 seconds - the timeout is short for the purposes of demonstration, in practical deployments the timeout would be much measured in hours
- For simplicity, this script is missing the error handling needed for production use.
- See Writing Applications for more information.
We are going to use
hping3 to simulate a DDoS attack, so install the software using the following command:
sudo apt install hping3
Run the following command to start sFlow-RT and run the
ddos.js script:
env RTPROP=-Dscript.file=ddos.js ./start.sh
Next, start Mininet with ONOS:
sudo mn --custom ~/onos/tools/dev/mininet/onos.py,sflow-rt/extras/sflow.py \
--link tc,bw=10 --controller onos,1 --topo tree,2,2
Generate normal traffic between hosts
h1 and
h3:
mininet-onos> iperf h1 h3
The weathermap view above shows the flow crossing the network from switch
s2 to
s3 via
s1.
Next, launch the simulated DNS amplification attack from
h1 to
h3:
mininet-onos> h1 hping3 --flood --udp -k -s 53 h3
The weathermap view verifies that the attack has been successfully blocked since none of the traffic is seen traversing the network.
The chart at the top of this article shows the iperf test followed by the simulated attack. The top chart shows the top flows entering the network, showing the DNS amplification attack traffic in
blue. The middle chart shows traffic broken out by switch port. Here, the
blue line shows the attack traffic arriving at switch
s2 port
s2-eth1 while the
orange line shows that only a small amount of traffic is forwarded to switch
s3 port
s3-eth3 before the attack is blocked at switch
s2 by the controller.
Mininet with ONOS and sFlow-RT is a great way to rapidly develop and test SDN applications, avoiding the time and expense involved in setting up a physical network. The application is easily moved from the Mininet virtual network to a physical network since it is based on the same industry standard sFlow telemetry generated by physical switches. In this case, using commodity switch hardware to cost effectively detect and filter massive (100's of Gbit/s) DDoS attacks.
