Security Enhancement of OpenFlow Networks

Graduation project (B.Sc. Electrical, Electronics & Communications Engineering) implementing and defending a Software-Defined Network (SDN) against Denial-of-Service (DoS) attacks using Mininet, the POX controller, and the OpenFlow protocol.

The project builds a virtual SDN topology, demonstrates a TCP SYN-flood DoS attack against a host on that topology, then implements and evaluates a controller-side firewall/mitigation module that detects and drops the malicious traffic in real time.

Submitted to the Electronics and Communications Department, 2024.

---

Table of Contents

• Overview
• Tech Stack
• Network Topology
• Repository Structure
• Getting Started
  • Prerequisites
  • Installation
• Usage
  • 1. Start the POX controllers
  • 2. Start the Mininet topology
  • 3. Simulate the DoS attack
  • 4. Observe the mitigation
• Results Summary
• Future Work
• Authors
• References
• License

---

Overview

Traditional networks struggle to respond quickly to DoS attacks because their control and data planes are tightly coupled and distributed. SDN decouples the control plane from the data plane, giving a controller a centralized, real-time view of the network — which this project uses to detect and mitigate an attack far more quickly than a traditional network could.

The project is split into two phases:

1. Network build-up — design and implement an SDN topology in Mininet, controlled by POX over OpenFlow, and validate normal client/server and client/client communication across it.
2. Attack & defense — launch a TCP SYN-flood DoS attack against a host in the topology, then implement a POX firewall module that detects the abnormal SYN rate and out-of-subnet traffic and drops it, restoring normal service.

Tech Stack

| Component | Purpose |

| Mininet | Virtual SDN network emulator (hosts, switches, links) | | POX | Python-based OpenFlow SDN controller | | Open vSwitch (OVS) | Virtual OpenFlow switch used by Mininet | | OpenFlow | Protocol between the controller and the switches | | hping3 | Crafts and floods the TCP SYN packets used in the attack | | nmap | Reconnaissance / port scanning during the attack scenario | | Wireshark / tcpdump | Packet capture and traffic analysis | | Ubuntu + Python 2.7 | Runtime environment (Mininet/POX are Python 2) |

Network Topology

The final topology used for the attack/mitigation experiments:

Final topology :(docs/images/topology-final.png)

• 2 controllers (c0, c1) — POX, cross-connected to both core switches for redundancy.
• 2 core switches (s1, s2) — linked to each other for load balancing and failover.
• 4 access switches (s3–s6) — one per group of hosts.
• 16 hosts (h1–h16) — 4 per access switch.

An earlier, single-controller/single-core-switch version of the topology is also included for reference: docs/images/topology-v1.png.

Repository Structure

├── mininet_topology/ │ └── topology.py Builds the Mininet network (hosts, switches, controllers, NAT) ├── controller/ │ └── firewall.py POX module: SYN-flood detection & subnet filtering ├── attack_scripts/ │ └── syn_flood_attack.sh nmap + hping3 commands used to simulate the DoS attack ├── docs/ │ ├── Graduation_Project_Report.pdf Full written report (all chapters, figures, references) │ └── images/ │ ├── topology-final.png │ └── topology-v1.png ├── README.md ├── LICENSE └── .gitignore

Getting Started

Prerequisites

• Ubuntu (the project was built and tested on Ubuntu; a VM is fine)
• Python 2.7 (Mininet and POX in this project are Python 2)
• Git

Installation

bash

1. Install Mininet sudo apt-get update sudo apt-get install git-core git clone git://github.com/mininet/mininet sudo apt-get install mininet

2. Install the POX controller mininet/util/install.sh -p

3. Install attack/analysis tools sudo apt-get install hping3 nmap wireshark tcpdump

4. Clone this repository git clone https://github.com//.git cd

5. Put the controller module where POX can find it cp controller/firewall.py ~/pox/ext/

Usage

1. Start the POX controllers

In the ~/pox directory, start each controller instance the topology expects (c0 on port 6102, c1 on port 6103 — adjust to match mininet_topology/topology.py if you change the ports):

bash cd ~/pox ./pox.py log.level --DEBUG openflow.of_01 --port=6102 forwarding.l2_pairs firewall

bash ./pox.py log.level --DEBUG openflow.of_01 --port=6103 forwarding.l2_pairs firewall

2. Start the Mininet topology

bash sudo python2 mininet_topology/topology.py

This drops you into the Mininet CLI once the network is built.

3. Simulate the DoS attack

From another terminal, open an xterm on the attacker host and the victim host:

bash mininet> xterm h16 h1

On h1, start a simple HTTP server on port 8080 to act as the victim service. On h16, run the attack:

bash bash attack_scripts/syn_flood_attack.sh

This scans the target with nmap, then floods it with spoofed TCP SYN packets using hping3.

4. Observe the mitigation

• Watch the POX controller log — you'll see Dropping packet: SYN flood detection warnings once the SYN rate crosses the threshold.

• Verify installed flow rules on a switch: bash mininet> sh ovs-ofctl dump-flows s1

• Capture traffic with Wireshark/tcpdump to confirm malicious SYNs and out-of-subnet traffic are being dropped while legitimate traffic keeps flowing.

Results Summary

• SYN packets exceeding the configured threshold (100 pkts/sec by default) were consistently detected and dropped.
• Traffic sourced from outside the trusted 10.0.0.0/8 subnet was dropped.
• Legitimate traffic continued to be served normally throughout the attack.
• SDN's centralized control allowed the defense to react in real time, which the report's literature review found to be a consistent advantage over rate limiting/firewalls/IDS in traditional, decentralized networks.

Full performance metrics, comparative analysis, and figures are in docs/Graduation_Project_Report.pdf (Chapter 4).

Future Work

• Explore more diverse topologies and a broader range of DoS/DDoS attack types beyond SYN flood.
• Investigate machine-learning-based detection for improved accuracy.
• Evaluate blockchain-based approaches to SDN security.
• Run larger-scale experiments closer to real-world traffic conditions.

Authors

• El Sayed Baiomy El Sayed

References

Full reference list (29 sources — papers, standards, and tools) is in the report, Section 5. Key sources include the ONF OpenFlow-enabled SDN/NFV solution brief, Kreutz & Ramos' Software-Defined Networking: A Comprehensive Survey, and the Mininet and Open vSwitch project documentation.

License

Add a license of your choice (e.g. MIT — see LICENSE). Academic report content in docs/ remains the copyright of its authors unless you state otherwise.