NetHCF: Filtering Spoofed IP Traffic With Programmable Switches

—In this paper, we identify the opportunity of using programmable switches to improve the state of the art in spoofed IP trafﬁc ﬁltering, and propose N ET HCF, a line-rate in-network system to ﬁlter spoofed trafﬁc. One key challenge in the design of N ET HCF is to handle the restrictions stemmed from the limited computational model and memory resources of programmable switches. We address this by decomposing the HCF scheme into two complementary parts, by aggregating the IP-to-Hop-Count (IP2HC) mapping table for efﬁcient memory usage, and by designing adaptive mechanisms to handle routing changes, IP popularity changes, and network activity dynamics. We implement an open-source prototype of N ET HCF, and conduct extensive evaluations. The evaluation results demonstrate that N ET HCF is able to process most legitimate trafﬁc in 1 µ s, ﬁlter spoofed IP trafﬁc effectively under network dynamics, with less than 30% of switch resource occupation.