TY - GEN
T1 - Analyzing Traffic by Domain Name in the Data Plane
AU - Kim, Jason
AU - Kim, Hyojoon
AU - Rexford, Jennifer
N1 - Publisher Copyright:
© 2021 ACM.
PY - 2021/10/11
Y1 - 2021/10/11
N2 - Associating network traffic with human-readable domain names, instead of low-level identifiers like IP addresses, is helpful for measuring traffic by domain name, rate-limiting packets by domain, and identifying IoT devices. However, existing monitoring techniques require examining traffic at an external compute node, introducing overhead and privacy risks. In this paper, we introduce Meta4, a framework for monitoring traffic by domain name in the data plane by extracting the client IP, server IP, and domain name from DNS response messages and associating the domain name with data traffic from the subsequent client-server session. A data-plane implementation has the benefits of running efficiently at line-rate, enabling the switch to take direct action on the packets (e.g., to rate-limit, block, or mark traffic based on the associated domain), and protecting the privacy of user information. We implemented Meta4 on an Intel Tofino switch and evaluated our prototype against packet traces from an operational network.
AB - Associating network traffic with human-readable domain names, instead of low-level identifiers like IP addresses, is helpful for measuring traffic by domain name, rate-limiting packets by domain, and identifying IoT devices. However, existing monitoring techniques require examining traffic at an external compute node, introducing overhead and privacy risks. In this paper, we introduce Meta4, a framework for monitoring traffic by domain name in the data plane by extracting the client IP, server IP, and domain name from DNS response messages and associating the domain name with data traffic from the subsequent client-server session. A data-plane implementation has the benefits of running efficiently at line-rate, enabling the switch to take direct action on the packets (e.g., to rate-limit, block, or mark traffic based on the associated domain), and protecting the privacy of user information. We implemented Meta4 on an Intel Tofino switch and evaluated our prototype against packet traces from an operational network.
KW - DNS
KW - Domain name
KW - P4
UR - http://www.scopus.com/inward/record.url?scp=85119434028&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85119434028&partnerID=8YFLogxK
U2 - 10.1145/3482898.3483357
DO - 10.1145/3482898.3483357
M3 - Conference contribution
AN - SCOPUS:85119434028
T3 - SOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research
SP - 1
EP - 12
BT - SOSR 2021 - Proceedings of the 2021 ACM SIGCOMM Symposium on SDN Research
PB - Association for Computing Machinery, Inc
T2 - 2021 ACM SIGCOMM Symposium on SDN Research, SOSR 2021
Y2 - 20 September 2021 through 21 September 2021
ER -