IMap: Fast and Scalable In-Network Scanning with Programmable Switches
Talkat 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI '22) · 2022-04-04..04-06·
summary
IMap turns P4-capable programmable switches into a high-speed in-network scanner that generates randomized probes from template packets, encodes per-probe secrets in mutable headers, and streams results to a storage server. The open-source prototype surveys a 25 billion scanning space in about 8 minutes (one port), sustains up to ~50 Mpps and can run at terabit line rates with all ports, claims ~4× speed and 1.5× accuracy vs prior work, and reduces storage load by ~93.8%.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:53Requirements to Network Scanners
- 2:36To Address Theses Limitations
- 2:48In-Network Scanning?
- 3:57Probe Packet Generation Generate probe packets with random address and adaptive rate
- 4:48Random Probe Address
- 8:00Adaptive Probe Rate Solve this scanning rate adjustment
- 8:16Response Packet Processing Process response packets correctly and efficiently
- 8:41Distinguish Response Packets
- 11:03Aggregating Response Packets
- 11:49Evaluation Overview • Implementation
- 12:31Overall Effectiveness
- 14:15Analysis of Scanning Results
related talks
54mNETMAP - a Simple and Convenient Open Source Framework for 10Gbits Traffic Processing
46mSelf-Programming Networks: Network Clock Synchronization, Event Playback and Real-time Action
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
16mA High-Speed Stateful Packet Processing Approach for Tbps Programmable Switches
32mSnabb Switch simple and fast packet networking
32mSnabb Switch simple and fast packet networking
32mSnabb Switch simple and fast packet networking
26mInternet Scanning - Current State and Lessons Learned