TY - GEN
T1 - Analyzing Traffic by Domain Name in the Data Plane
AU - Kim, Jason
AU - Kim, Hyojoon
AU - Rexford, Jennifer
N1 - Funding Information:
We want to thank Xiaoqi Chen, Mary Hogan, Mengying Pan, Ross Teixeira, Yufei Zheng, and the anonymous reviewers for their helpful feedback. We also thank our shepherd, Kai Gao, for his great guidance. We want to thank Princeton University’s Office of Information Technology, Office of Institutional Research, and the Institutional Review Board for reviewing our work and helping us evaluate our work with anonymized campus traffic. This material is based upon work supported by NSF Grant number CNS-1704077 and the Defense Advanced Research Projects Agency (DARPA) under Contract No. HR001120C0107.
Publisher Copyright:
© 2021 ACM.
PY - 2021/10/11
Y1 - 2021/10/11
N2 - Associating network traffic with human-readable domain names, instead of low-level identifiers like IP addresses, is helpful for measuring traffic by domain name, rate-limiting packets by domain, and identifying IoT devices. However, existing monitoring techniques require examining traffic at an external compute node, introducing overhead and privacy risks. In this paper, we introduce Meta4, a framework for monitoring traffic by domain name in the data plane by extracting the client IP, server IP, and domain name from DNS response messages and associating the domain name with data traffic from the subsequent client-server session. A data-plane implementation has the benefits of running efficiently at line-rate, enabling the switch to take direct action on the packets (e.g., to rate-limit, block, or mark traffic based on the associated domain), and protecting the privacy of user information. We implemented Meta4 on an Intel Tofino switch and evaluated our prototype against packet traces from an operational network.
AB - Associating network traffic with human-readable domain names, instead of low-level identifiers like IP addresses, is helpful for measuring traffic by domain name, rate-limiting packets by domain, and identifying IoT devices. However, existing monitoring techniques require examining traffic at an external compute node, introducing overhead and privacy risks. In this paper, we introduce Meta4, a framework for monitoring traffic by domain name in the data plane by extracting the client IP, server IP, and domain name from DNS response messages and associating the domain name with data traffic from the subsequent client-server session. A data-plane implementation has the benefits of running efficiently at line-rate, enabling the switch to take direct action on the packets (e.g., to rate-limit, block, or mark traffic based on the associated domain), and protecting the privacy of user information. We implemented Meta4 on an Intel Tofino switch and evaluated our prototype against packet traces from an operational network.
KW - DNS
KW - Domain name
KW - P4
UR - http://www.scopus.com/inward/record.url?scp=85119434028&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85119434028&partnerID=8YFLogxK
U2 - 10.1145/3482898.3483357
DO - 10.1145/3482898.3483357
M3 - Conference contribution
AN - SCOPUS:85119434028
T3 - SOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research
SP - 1
EP - 12
BT - SOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research
PB - Association for Computing Machinery, Inc
T2 - 2021 ACM SIGCOMM Symposium on SDN Research, SOSR 2021
Y2 - 20 September 2021 through 21 September 2021
ER -