Experiment Task Design:

Transcription

1 Experiment Task Design: In this task, students should demonstrate how the DOS attack on data-plane works, and describe the observed consequence. The following sections give stepby-step instructions to assist students in installing required software s, creating the experimental topology and carrying out the Denial of Service Attack(DOS). We assume that students have created their accounts on CloudLab and have access to this accounts. Submission: Students should submit screen shots of step-3, step-4, step-5, step-6 and step-7. Explain each screenshot in one or two paragraphs. Profile In the CloudLab-based laboratory, there is a profile of the experiment that will be used by the students to demonstrate the DOS attack. A topology of the design is shown below. This topology consists of a single bare_metal raw pc, that runs ubuntu linux. Step 1: The first step is to login into cloudlab ( ). Enter your cloudlab credentials on the login page. The page shown below will appear on your screen. Use the topology profile link shared with you.

2 Click "Next" button on the "Select a Profile" page above. On "Finalize" page give an optional name, choose any available cluster and click the "Finish" button to instantiate the topology. Step 2: Installations Once the profile is instantiated, the student must install mininet ( mininet), floodlight ( with its pre-requisites and hping3 into this node. To install all this open source softwares please follow the step-by-step instructions listed below. Make sure to have each part working correctly since a mishap on one part will adversely affect other parts. NOTE: These installations will not be saved when you terminate the cloudlab experiment. Cloudlab allows you to request more time by using the Extend button the on the status page. You would need to provide a written justification for holding onto your resources for a longer period of time. Short of this step it will be mandatory to redo the upcoming installation steps(step1 of the manual). Step 2.1: Open Shell Once the experiment is running, you will see the topology similar to the one below in the "Topology View" tab. A terminal shell is required to carry out this lab. So to pull up the terminal shell, left-click on the node and then select "Shell" from the menu. You will be

3 redirected to a new Shell (it is required to stay on this shell until the terminal finishes loading). Step 2.2: Install the add-apt-repository CLI utility On this new shell, install software-properties-common package to get access to the add-aptrepository command line utility. sudo apt-get install -y software-properties-common Step 2.3: Install the webupd8team PPA( Personal Package Archive) The webupd8team personal package archive contains the Java 8 installations needed to run floodlight.

4 Install this PPA type: sudo add-apt-repository ppa:webupd8team/java Update all your repositories using the command: sudo apt-get update Step 2.4: Install Oracle Java 8 (JDK8 and JRE8) Install Oracle Java 8 (JDK8 and JRE8) from the webupd8team/java PPA. Install the oracle installer using the command: sudo apt-get install oracle-java8-installer Set Oracle Java 8 as the default Java installation using: sudo apt-get install oracle-java8- set-default Step 2.5: Install Maven, Ant, python-dev and Build-essential This pre-requisites need to be installed in order to build the floodlight.jar file used to run floodlight.

5 To install them type plus enter: sudo apt-get install build-essential maven ant pythondev Step 2.6: Clone Floodlight from Github and build the jar file To clone floodlight from github type: git clone git://github.com/floodlight/floodlight.git The floodlight directory will be downloaded. Enter into this directory using: cd floodlight - git submodule init - git submodule update Run the floodlight build.xml file to create the jar file by entering: ant - sudo mkdir /var/lib/floodlight - sudo chmod 777 /var/lib/floodlight

6 Step 2.7: Clone mininet from github and Install Note: Make sure to cd.. out of the floodlight directory. To clone mininet from github enter: git clone git://github.com/mininet/mininet Once installed enter mininet directory using: cd mininet List available branches: git tag Enter the branch version you want to install: git checkout -b Back out of the mininet directory: cd.. Install mininet by runinng the install.sh executable file: mininet/util/install.sh -a

7 Step 2.8:Install Hping3 Install Hping3 using the command: sudo apt-get install hping3 Step 3: Open a shell, enter floodlight directory and then run floodlight by typing java -jar target/floodlight.jar Step 4: In another terminal start mininet with the below command: sudo mn --controller=remote,ip= ,port= switch ovsk,protocols=openflow13

8 This will create two hosts connected to a openvswitch bridge, which in turn is connected to the floodlight controller spawned in the previous step. The topology looks like this: Try pingall in the mininet shell and confirm that the host are able to ping each other. Step 5: In another shell terminal print the current flow-rules inside the switch. The list should be empty at this point.

9 Step 6: Get into the bash shell of h1 and then use hping3 to send a packet flood to h2. We use random-source option with hping3; this ensures that the packets have different source IP address. Thus, every packet results in a flow-table miss and a OFPT_PACKET_IN is sent to the controller. Controller in turn sends a OFPT_FLOW_MOD to the switch and installs a new flow-rule into the switch. Thus every packet results in a new flow rule being downloaded to the switch. Type h1 before the hping3 and is the ip of h2. While the hping3 is running, check the flow-rule list in another terminal using sudo ovsofctl dump-flows s1 -O OpenFlow13 command; you will see a huge list of flow-rules in the table: Step 7: Once the list list of flow-rules is printed completely in the console, stop the hping3 running in the other console by typing ctrl + c on the mininet shell. Thereafter, ping h2 ( ) on the mininet shell using h1 ping h2. Since the flow-table is exhausted due to DOS attack, ping won t work. Wait for 2-3 mins, and try the ping. It should work, since by this time the flow-entries have expired and the flow-table has become empty. Confirm this by printing the flow-table rules using the sudo ovs-ofctl dump-flows s1 -O OpenFlow13 command. EXPLANATION: When the switch s flow table is full, upon receiving an instruction to install a flow rule, the switch detects that there is no more space in the flow table. As the switch cannot install this rule it sends an OFPT_ERROR message to the controller with error code

10 OFPFMFC_TABLE_FULL. It then drops this packet.the switch cannot forward buffered packets until there is space in the flow table to install new flow rules.