P4 Developer Days – MORP4: A Dynamic Network Telescope

Abstract

A network telescope passively monitors unsolicited traffic reaching unused Internet address space advertised to the global routing system. For more than two decades, network telescopes have allowed unique global visibility into a wide range of Internet phenomena. However, telescopes are afflicted by two main issues: progressive erosion due to IPv4 space unavailability and blacklisting. To overcome these issues, we propose MORP4, a programmable data-plane framework implementing a “dynamic” network telescope.

MORP4 accurately and adaptively tracks unused space of an organization’s network with configurable time and space granularity and captures only traffic directed towards unused addresses at line rate. We provide an implementation in P4 and Python/C++, and deploy it on a Tofino switch. We show that it can detect unused IPv4 address space at the finest granularity (/32) while operating at line rate and provide an effective approach for operating a telescope in the IPv6 domain.

Speaker

Iliana is a fourth-year PhD student in Computer Science at Georgia Tech, supervised by Prof. Dainotti. Her research focuses on interdomain routing security and Internet measurements. She holds a Diploma in Electrical and Computer Engineering from the National Technical University of Athens. Iliana is particularly interested in detecting and analyzing BGP routing anomalies and conducting network telescope measurements with the use of programmable switches. Her work aims to shed more light on current trends in misconfigurations and attacks in both the control and data planes. Iliana is also a recipient of the Onassis Foundation Scholarship.