Hash tables for efficient flow monitoring: vulnerabilities and countermeasures

Proceedings - Conference on Local Computer Networks, LCN

Volumn , Issue , 2009, Pages 1087-1094

  Eckhoff, David ^a   Limmer, Tobias ^a   Dressler, Falko ^a  

^a UNIVERSITY OF ERLANGEN NUREMBERG   (Germany)

Author keywords

Denial of service; Flow monitoring; Hash collision; Targeted attacks

Indexed keywords

COMPUTATIONAL POWER; DENIAL OF SERVICE; FLOW MONITORING; HASH ALGORITHM; HASH COLLISIONS; HASH TABLE; HASH VALUE; LOOKUPS; NETWORK MONITORING TOOLS; OPTIMAL CONDITIONS; OPTIMAL UTILIZATION; SOFTWARE-BASED; VERMONT;

COMPUTATIONAL EFFICIENCY; COMPUTER SOFTWARE; HASH FUNCTIONS; INTERNET; TABLE LOOKUP; TRANSMISSION CONTROL PROTOCOL;

COMPUTER CRIME;

EID: 77951260620     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/LCN.2009.5355211     Document Type: Conference Paper

References (20)

1. R. Sommer and A. Feldmann, "NetFlow: information loss or win?" in 2nd ACM SIGCOMM Internet Measurement Workshop (IMW 2002). Marseille, France: ACM, November 2002, pp. 173-174.
2. T. Limmer and F. Dressler, "Seamless Dynamic Reconfiguration of Flow Meters: Requirements and Solutions," in 16. GI/ITG Fachtagung Kommunikation in Verteilten Systemen (KiVS 2009). Kassel, Germany: Springer, March 2009, pp. 179-190.
3. R. T. Lampert, C. Sommer, G. Münz, and F. Dressler, "Vermont - A Versatile Monitoring Toolkit Using IPFIX/PSAMP," in IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation (MonAM 2006). Tübingen, Germany: IEEE, September 2006, pp. 62-65.
4. L. Deri, "nProbe: an Open Source NetFlow Probe for Gigabit Networks," in TERENA Networking Conference (TNC 2003), Zagreb, Croatia, May 2003.
5. B. Claise, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information," IETF, RFC 5101, January 2008.
6. J. Quittek, S. Bryant, B. Claise, P. Aitken, and J. Meyer, "Information Model for IP Flow Information Export," IETF, RFC 5102, January 2008.
7. B. Claise, "Cisco Systems NetFlow Services Export Version 9," IETF, Tech. Rep. RFC 3954, October 2004.
8. G. Carle, F. Dressler, R. A. Kemmerer, H. König, C. Kruegel, and P. Laskov, "Manifesto - Perspectives Workshop: Network Attack Detection and Defense," in Dagstuhl Perspectives Workshop 08102 - Network Attack Detection and Defense 2008, Schloss Dagstuhl, Wadern, Germany, March 2008.
9. D. V. Sarwate, "Computation of Cyclic Redundancy Checks via Table Look-Up," Communications of the ACM, vol. 31, no. 8, pp. 1008-1013, 1988.
10. Anarchriz/DREAD, "CRC and how to Reverse it," April 1999. [Online]. Available: http://www.woodmann.com/RCE-CD-SITES/Anachriz/programming/ crc.htm
11. K. Brayer and J. L. Hammond Jr, "Evaluation of error detection polynomial performance on the AUTOVON channel," in National Telecommunications Conference, vol. 1. New Orleans, LA: IEEE, December 1975, pp. 8-21 to 8-25.
12. B. Maxwell, D. R. Thompson, G. Amerson, and L. Johnson, "Analysis of CRC methods and potential data integrity exploits," in International Conference on Emerging Technologies, Minneapolis, MI, August 2003, pp. 25-26.
13. H. Wang, D. Zhang, and K. G. Shin, "Detecting SYN Flooding Attacks," in 21st IEEE Conference on Computer Communications (IEEE INFOCOM 2002), New York, NY, June 2002.
14. A. Turner, "tcpreplay." [Online]. Available: http://tcpreplay.synfin.net/trac/wiki/tcpreplay
15. D. Eastlake and P. Jones, "US secure hash algorithm 1 (SHA1)," IETF, RFC 3174, September 2001.
16. J. L. Carter and M. N. Wegman, "Universal classes of hash functions," in 9th ACM Symposium on Theory of Computing. Boulder, CO: ACM, May 1977, pp. 106-112.
17. S. Crosby and D. Wallach, "Denial of Service via Algorithmic Complexity Attacks," in 12th USENIX Security Symposium, Washington, D.C., August 2003, pp. 3-3
18. J. Black, S. Halevi, H. Krawczyk, T. Krovetz, and P. Rogaway, "UMAC: Fast and secure message authentication," in 19th International Cryptology Conference (Advances in Cryptology, CRYPTO '99), vol.LNCS 1666, Santa Barbara, CA, August 1999, pp. 216-233.
19. D. Bernstein, "Floating-point arithmetic and message authentication," March 2000. [Online]. Available: http://cr.yp.to/hash127. html
20. R. Rivest, "The MD5 Message-Digest Algorithm," IETF, RFC 1321, April 1992.