Analyzing Traffic by Domain Name in the Data Plane

Jason Kim, Hyojoon Kim, Jennifer Rexford

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Associating network traffic with human-readable domain names, instead of low-level identifiers like IP addresses, is helpful for measuring traffic by domain name, rate-limiting packets by domain, and identifying IoT devices. However, existing monitoring techniques require examining traffic at an external compute node, introducing overhead and privacy risks. In this paper, we introduce Meta4, a framework for monitoring traffic by domain name in the data plane by extracting the client IP, server IP, and domain name from DNS response messages and associating the domain name with data traffic from the subsequent client-server session. A data-plane implementation has the benefits of running efficiently at line-rate, enabling the switch to take direct action on the packets (e.g., to rate-limit, block, or mark traffic based on the associated domain), and protecting the privacy of user information. We implemented Meta4 on an Intel Tofino switch and evaluated our prototype against packet traces from an operational network.

Original languageEnglish (US)
Title of host publicationSOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research
PublisherAssociation for Computing Machinery, Inc
Pages1-12
Number of pages12
ISBN (Electronic)9781450390842
DOIs
StatePublished - Oct 11 2021
Event2021 ACM SIGCOMM Symposium on SDN Research, SOSR 2021 - Virtual, Online, United States
Duration: Sep 20 2021Sep 21 2021

Publication series

NameSOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research

Conference

Conference2021 ACM SIGCOMM Symposium on SDN Research, SOSR 2021
Country/TerritoryUnited States
CityVirtual, Online
Period9/20/219/21/21

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software

Keywords

  • DNS
  • Domain name
  • P4

Fingerprint

Dive into the research topics of 'Analyzing Traffic by Domain Name in the Data Plane'. Together they form a unique fingerprint.

Cite this