[ovs-dev] Is the Open Flow switch able to calculate the gap of sequence number

[Soliman Awad Alshra´a Abdullah TU Ilmenau]

Dear All,
First of all , I apologize if I send my inquiry to the wrong Email list

I have read in some publication


OpenFLow switch is able to keep track of the sequence number of each traffic 
flow to detect MAC spoofing attack. Upon reception of a frame, the algorithm 
calculates the gap G between the sequence number of the current frame and that 
of the last frame received from the same source address. If G = 0, the current 
frame is considered as a re-transmitted frame, while if G = 1 or G = 2, the 
current frame is considered the right one. But, if the gap between the current 
frame and previous frame is in between 3 and 4096, then it is considered an 
abnormal sequence number.

In my case, I use Ryu Controller and I would like to do the same work, where 
the switch sends the alert to the controller after the switch detects the gap.



M.Sc Abdullah Soliman
Technische Universität Ilmenau
Fakultät für Elektrotechnik und Informationstechnik
Fachgebiet Kommunikationsnetze
Besucheradresse:
Helmholtzplatz 2
98693 Ilmenau

Postadresse:
PF 10 05 65
98684 Ilmenau


Telefon

+49 3677 69-2698

[cid:image001.png@01D62526.1691FEE0]  
abdullah.alsh...@tu-ilmenau.de
[cid:image002.png@01D62526.1691FEE0]  
www.tu-ilmenau.de/it-kn

[cid:image003.jpg@01D62526.1691FEE0]



[cid:image004.png@01D62526.1691FEE0]



___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of sequence number

[Ben Pfaff]

On Fri, Oct 23, 2020 at 02:38:06PM +, Soliman Awad Alshra´a Abdullah TU 
Ilmenau wrote:
> OpenFLow switch is able to keep track of the sequence number of each traffic 
> flow to detect MAC spoofing attack. Upon reception of a frame, the algorithm 
> calculates the gap G between the sequence number of the current frame and 
> that of the last frame received from the same source address. If G = 0, the 
> current frame is considered as a re-transmitted frame, while if G = 1 or G = 
> 2, the current frame is considered the right one. But, if the gap between the 
> current frame and previous frame is in between 3 and 4096, then it is 
> considered an abnormal sequence number.
> 
> In my case, I use Ryu Controller and I would like to do the same work, where 
> the switch sends the alert to the controller after the switch detects the gap.

This doesn't make sense to me.  Frames don't have sequence numbers.

Can you cite the publication that makes this claim?
___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of sequence number

[Ben Pfaff]

Oh, it's about wireless.  OVS doesn't have special 802.11 support.

On Tue, Oct 27, 2020 at 06:51:08AM +, Soliman Awad Alshra´a Abdullah TU 
Ilmenau wrote:
> 
> Dear sir,
> 
> 
> Attached you find the requested article
> 
> Thanks
> M.Sc Abdullah Soliman
> Technische Universität Ilmenau
> Fakultät für Elektrotechnik und Informationstechnik
> Fachgebiet Kommunikationsnetze
> Besucheradresse:
> Helmholtzplatz 2
> 98693 Ilmenau
> 
> Postadresse:
> PF 10 05 65
> 98684 Ilmenau
> 
> 
> Telefon
> 
> +49 3677 69-2698
> 
> [cid:image001.png@01D62526.1691FEE0]  
> abdullah.alsh...@tu-ilmenau.de<mailto:jochen.se...@tu-ilmenau.de>
> [cid:image002.png@01D62526.1691FEE0]  
> www.tu-ilmenau.de/it-kn<https://www.tu-ilmenau.de/it-kn>
> 
> [cid:image003.jpg@01D62526.1691FEE0]
> 
> 
> 
> [cid:image004.png@01D62526.1691FEE0]
> 
> 
> 
> 
> From: Ben Pfaff 
> Sent: 26 October 2020 18:44:03
> To: Soliman Awad Alshra´a Abdullah TU Ilmenau
> Cc: ovs-dev@openvswitch.org
> Subject: Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of 
> sequence number
> 
> On Fri, Oct 23, 2020 at 02:38:06PM +, Soliman Awad Alshra´a Abdullah TU 
> Ilmenau wrote:
> > OpenFLow switch is able to keep track of the sequence number of each 
> > traffic flow to detect MAC spoofing attack. Upon reception of a frame, the 
> > algorithm calculates the gap G between the sequence number of the current 
> > frame and that of the last frame received from the same source address. If 
> > G = 0, the current frame is considered as a re-transmitted frame, while if 
> > G = 1 or G = 2, the current frame is considered the right one. But, if the 
> > gap between the current frame and previous frame is in between 3 and 4096, 
> > then it is considered an abnormal sequence number.
> >
> > In my case, I use Ryu Controller and I would like to do the same work, 
> > where the switch sends the alert to the controller after the switch detects 
> > the gap.
> 
> This doesn't make sense to me.  Frames don't have sequence numbers.
> 
> Can you cite the publication that makes this claim?


___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of sequence number

[Ben Pfaff]

I get the impression (from the article) that 802.11 wireless framing
includes a sequence number.  Maybe it is the "sequence control" in the
diagram here: https://en.wikipedia.org/wiki/802.11_Frame_Types.  If so,
OVS doesn't have or provide access to it, so it can't calculate gaps.

On Wed, Nov 04, 2020 at 09:20:33AM +, Soliman Awad Alshra´a Abdullah TU 
Ilmenau wrote:
> 
> Dear Ben,
> 
> I see what you meant, but the author speaks about using the ovs, Does not he 
> ?. So from my side, no difference if it is wireless or wire network ?
> 
> Thanks
> 
> M.Sc Abdullah Soliman
> Technische Universität Ilmenau
> Fakultät für Elektrotechnik und Informationstechnik
> Fachgebiet Kommunikationsnetze
> Besucheradresse:
> Helmholtzplatz 2
> 98693 Ilmenau
> 
> Postadresse:
> PF 10 05 65
> 98684 Ilmenau
> 
> 
> Telefon
> 
> +49 3677 69-2698
> 
> [cid:image001.png@01D62526.1691FEE0]  
> abdullah.alsh...@tu-ilmenau.de<mailto:jochen.se...@tu-ilmenau.de>
> [cid:image002.png@01D62526.1691FEE0]  
> www.tu-ilmenau.de/it-kn<https://www.tu-ilmenau.de/it-kn>
> 
> [cid:image003.jpg@01D62526.1691FEE0]
> 
> 
> 
> [cid:image004.png@01D62526.1691FEE0]
> 
> 
> 
> ____
> From: Ben Pfaff 
> Sent: 03 November 2020 17:52:19
> To: Soliman Awad Alshra´a Abdullah TU Ilmenau
> Cc: d...@openvswitch.org
> Subject: Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of 
> sequence number
> 
> Oh, it's about wireless.  OVS doesn't have special 802.11 support.
> 
> On Tue, Oct 27, 2020 at 06:51:08AM +, Soliman Awad Alshra´a Abdullah TU 
> Ilmenau wrote:
> >
> > Dear sir,
> >
> >
> > Attached you find the requested article
> >
> > Thanks
> > M.Sc Abdullah Soliman
> > Technische Universität Ilmenau
> > Fakultät für Elektrotechnik und Informationstechnik
> > Fachgebiet Kommunikationsnetze
> > Besucheradresse:
> > Helmholtzplatz 2
> > 98693 Ilmenau
> >
> > Postadresse:
> > PF 10 05 65
> > 98684 Ilmenau
> >
> >
> > Telefon
> >
> > +49 3677 69-2698
> >
> > [cid:image001.png@01D62526.1691FEE0]  
> > abdullah.alsh...@tu-ilmenau.de<mailto:jochen.se...@tu-ilmenau.de>
> > [cid:image002.png@01D62526.1691FEE0]  
> > www.tu-ilmenau.de/it-kn<https://www.tu-ilmenau.de/it-kn<http://www.tu-ilmenau.de/it-kn<https://www.tu-ilmenau.de/it-kn>>
> >
> > [cid:image003.jpg@01D62526.1691FEE0]
> >
> >
> >
> > [cid:image004.png@01D62526.1691FEE0]
> >
> >
> >
> > 
> > From: Ben Pfaff 
> > Sent: 26 October 2020 18:44:03
> > To: Soliman Awad Alshra´a Abdullah TU Ilmenau
> > Cc: ovs-dev@openvswitch.org
> > Subject: Re: [ovs-dev] Is the Open Flow switch able to calculate the gap of 
> > sequence number
> >
> > On Fri, Oct 23, 2020 at 02:38:06PM +, Soliman Awad Alshra´a Abdullah TU 
> > Ilmenau wrote:
> > > OpenFLow switch is able to keep track of the sequence number of each 
> > > traffic flow to detect MAC spoofing attack. Upon reception of a frame, 
> > > the algorithm calculates the gap G between the sequence number of the 
> > > current frame and that of the last frame received from the same source 
> > > address. If G = 0, the current frame is considered as a re-transmitted 
> > > frame, while if G = 1 or G = 2, the current frame is considered the right 
> > > one. But, if the gap between the current frame and previous frame is in 
> > > between 3 and 4096, then it is considered an abnormal sequence number.
> > >
> > > In my case, I use Ryu Controller and I would like to do the same work, 
> > > where the switch sends the alert to the controller after the switch 
> > > detects the gap.
> >
> > This doesn't make sense to me.  Frames don't have sequence numbers.
> >
> > Can you cite the publication that makes this claim?
> 
> 
___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev