P4Drop: A lightweight security function for filtering TCP spoofing packets on programmable switches

Abstract

TCP spoofing is a network attack technique in which attackers forge the source IP address of packets to impersonate trusted sources, commonly employed in denial-of-service attacks and session hijacking. Traditional defense methods, whether host-based or SDN-based, suffer from deployment challenges, latency issues, or high overhead on the control plane. To address these shortcomings, we propose P4Drop, a lightweight function on the P4 programmable data plane that operates without the involvement of the control plane. This method effectively defends against source address spoofing attacks based on the TCP protocol. Experimental results demonstrate that P4Drop can rapidly establish a trust mechanism and filter spoofing TCP traffic after receiving a small number of packets. Compared with existing solutions, the IP Spoofing detection method deployed on the data plane, the false negative rate was reduced by roughly 6% for the same memory consumption. We demonstrated P4Drop’s ability to detect and defend attacks quickly with low latency.