[Help] Instruct switch to drop all packets from affected DDoS port

[lorenzomonta]

I am writing code to mitigate DDoS attacks. I can currently identify the switch ports for all switches from which DoS attacks originate. I can't figure out how I can, given the port and dpid of the switch, instruct the switch to drop all packages coming only from the affected port. So maybe I could use update the switch's flow table? but how I could that? Finally, when the DDoS attack is over, how can I remove that rule? Can you help me? Thanks!

[MurphyMc]

My OpenFlow is rusty, but I think the core of it should be something like this...

import libopenflow_01 as of

# Add rule that drops
msg = of.ofp_flow_mod()
msg.match.in_port = BLOCK_PORT
core.openflow.sendToDPID(BLOCK_DPID, msg)

# Remove rule that drops
msg = of.ofp_flow_mod(command = of.OFPFC_DELETE_STRICT)
msg.match.in_port = BLOCK_PORT
core.openflow.sendToDPID(BLOCK_DPID, msg)

[lorenzomonta]

My OpenFlow is rusty, but I think the core of it should be something like this...

import libopenflow_01 as of

# Add rule that drops

msg = of.ofp_flow_mod()

msg.match.in_port = BLOCK_PORT

core.openflow.sendToDPID(BLOCK_DPID, msg)

# Remove rule that drops

msg = of.ofp_flow_mod(command = of.OFPFC_DELETE_STRICT)

msg.match.in_port = BLOCK_PORT

core.openflow.sendToDPID(BLOCK_DPID, msg)

Thank you very very much!! It works fine! Where I can read some documentation about Openflow using Python with some example?

Thanks a lot!

[MurphyMc]

A few possibilities:

• The POX repository has a number of examples; the "forwarding" components in particular might be a decent place to start.
• The POX documentation has a section on using OpenFlow with POX: https://noxrepo.github.io/pox-doc/html/
• The Mininet OpenFlow Tutorial has a section: https://github.com/mininet/openflow-tutorial/wiki/Create-a-Learning-Switch
• The mainline POX only has support for OpenFlow 1.0 and some Nicira (OVS) extensions. The original OpenFlow 1.0 spec is not that long or complicated, and POX's OpenFlow corresponds to it pretty closely except that it's much easier to use since, e.g., it has reasonable defaults and computed values for many fields: https://opennetworking.org/wp-content/uploads/2013/04/openflow-spec-v1.0.0.pdf

Good luck!

[lorenzomonta]

Thank you very much, you have been very helpful! Thank you very much!