Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ReAct: Reflection Attack Mitigation For Asymmetric Routing

David Hay, Mary Hogan, Shir Landau Feibish

TL;DR

ReAct addresses Amplification Reflection DDoS (AR-DDoS) by enabling in-network correlation of requests and responses across switches. It introduces a sliding-window of Bloom filters ( Requests_BF ) and a data-plane forwarding mechanism ( Request_Forwarding_Table, Forwarded_Requests ) to support joins in both symmetric and asymmetric routing scenarios, implemented on the Lucid P4 platform and NVIDIA BlueField-3 SmartNIC. Empirical results show near-complete filtering of attack traffic with low false positives and minimal coordination overhead, outperforming prior Symmetry-dependent approaches. The work demonstrates practical applicability for modern networks with path asymmetry and highlights automatic adaptation to routing changes as a key strength.

Abstract

Amplification Reflection Distributed Denial-of-Service (AR-DDoS) attacks remain a formidable threat, exploiting stateless protocols to flood victims with illegitimate traffic. Recent advances have enabled data-plane defenses against such attacks, but existing solutions typically assume symmetric routing and are limited to a single switch. These assumptions fail in modern networks where asymmetry is common, resulting in dropped legitimate responses and persistent connectivity issues. This paper presents ReAct, an in-network defense for AR-DDoS that is robust to asymmetry. ReAct performs request-response correlation across switches using programmable data planes and a sliding-window of Bloom filters. To handle asymmetric traffic, ReAct introduces a data-plane-based request forwarding mechanism, enabling switches to validate responses even when paths differ. ReAct can automatically adapt to routing changes with minimal intervention, ensuring continued protection even in dynamic network environments. We implemented ReAct on both a P4 interpreter and NVIDIAs Bluefield-3, demonstrating its applicability across multiple platforms. Evaluation results show that ReAct filters nearly all attack traffic without dropping legitimate responses-even under high-volume attacks and asymmetry. Compared to state-of-the-art approaches, ReAct achieves significantly lower false positives. To our knowledge, ReAct is the first data-plane AR-DDoS defense that supports dynamic, cross-switch collaboration, making it uniquely suitable for deployment in networks with asymmetry.

ReAct: Reflection Attack Mitigation For Asymmetric Routing

TL;DR

ReAct addresses Amplification Reflection DDoS (AR-DDoS) by enabling in-network correlation of requests and responses across switches. It introduces a sliding-window of Bloom filters ( Requests_BF ) and a data-plane forwarding mechanism ( Request_Forwarding_Table, Forwarded_Requests ) to support joins in both symmetric and asymmetric routing scenarios, implemented on the Lucid P4 platform and NVIDIA BlueField-3 SmartNIC. Empirical results show near-complete filtering of attack traffic with low false positives and minimal coordination overhead, outperforming prior Symmetry-dependent approaches. The work demonstrates practical applicability for modern networks with path asymmetry and highlights automatic adaptation to routing changes as a key strength.

Abstract

Amplification Reflection Distributed Denial-of-Service (AR-DDoS) attacks remain a formidable threat, exploiting stateless protocols to flood victims with illegitimate traffic. Recent advances have enabled data-plane defenses against such attacks, but existing solutions typically assume symmetric routing and are limited to a single switch. These assumptions fail in modern networks where asymmetry is common, resulting in dropped legitimate responses and persistent connectivity issues. This paper presents ReAct, an in-network defense for AR-DDoS that is robust to asymmetry. ReAct performs request-response correlation across switches using programmable data planes and a sliding-window of Bloom filters. To handle asymmetric traffic, ReAct introduces a data-plane-based request forwarding mechanism, enabling switches to validate responses even when paths differ. ReAct can automatically adapt to routing changes with minimal intervention, ensuring continued protection even in dynamic network environments. We implemented ReAct on both a P4 interpreter and NVIDIAs Bluefield-3, demonstrating its applicability across multiple platforms. Evaluation results show that ReAct filters nearly all attack traffic without dropping legitimate responses-even under high-volume attacks and asymmetry. Compared to state-of-the-art approaches, ReAct achieves significantly lower false positives. To our knowledge, ReAct is the first data-plane AR-DDoS defense that supports dynamic, cross-switch collaboration, making it uniquely suitable for deployment in networks with asymmetry.
Paper Structure (16 sections, 6 figures, 1 table)

This paper contains 16 sections, 6 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background
  3. Amplification Reflection DDoS Attacks
  4. Handling AR-DDoS in the Data Plane
  5. ReAct Design
  6. ReAct for Symmetric Routing
  7. ReAct for Asymmetric Routing
  8. Implementation
  9. Implementation of ReAct on a Programmable Switch
  10. Implementation of ReAct on a SmartNIC
  11. Evaluation
  12. Experiments the BlueField-3 Implementation
  13. Experiments with the Lucid implementation
  14. Limitations
  15. Related Work
  16. ...and 1 more sections

Figures (6)

  • Figure 1: ReAct in Symmetric Routing
  • Figure 2: ReAct's sliding window structure
  • Figure 3: ReAct in Asymmetric Routing
  • Figure 4: Sensitivity of ReAct to the request rate $r$ and interval length $\tau$. The false negative rate captures the attack traffic that is misclassified and forwarded to the client.
  • Figure 5: Comparison between ReAct and CBF.
  • ...and 1 more figures