Air Force Institute of Technology

Fingerprinting Software Defined Networks and Controllers Air Force Institute of Technology

This book attempts to identify information that is unintentionally offered to a network attacker when SDN is used within a small network, and demonstrates the feasibility of uniquely identifying the software managing the SDN environment. With positive identification of the software controlling the SDN environment (a process knownas fingerprinting), an attacker can then search for existing vulnerabilities or attempt to develop custom attacks against the logically centralized software. Preventing an attacker's discovery of the network controller assists in thwarting the attacker's reconnaissance, ultimately inhibiting the attacker's capabilities. If an attacker is unable to uniquely identify a target, then the list of available vulnerabilities at the attacker's disposal is limited, and the attacker's threat is minimized. Focusing on assessing whether fingerprinting is possible, this book attempts to identify first when SDN is deployed, and then proceeds to gather intelligence in the form of unique features that describe the SDN controller software. The end of this collection of features occurs when the SDN software is successfully fingerprinted. The methods of collecting data are restricted to the methods available to an attacker. An attacker is assumed to have a presence in the network in the form of a connection to the network switching fabric. The attacker can also communicate to other end hosts on the network, including a host that is another point of presence for the attacker (i.e., the attacker can have two points of presence on the network to communicate between).