US 11,750,622 B1
Forwarding element with a data plane DDoS attack detector
Changhoon Kim, Palo Alto, CA (US); Jeongkeun Lee, Mountain View, CA (US); and Masoud Moshref Javadi, Sunnyvale, CA (US)
Assigned to Barefoot Networks, Inc., Santa Clara, CA (US)
Filed by Barefoot Networks, Inc., Santa Clara, CA (US)
Filed on Feb. 15, 2018, as Appl. No. 15/897,361.
Claims priority of provisional application 62/556,470, filed on Sep. 10, 2017.
Claims priority of provisional application 62/554,024, filed on Sep. 5, 2017.
Int. Cl. H04L 9/40 (2022.01); G06F 17/18 (2006.01); H04L 43/0876 (2022.01); H04L 41/0816 (2022.01)
CPC H04L 63/1416 (2013.01) [G06F 17/18 (2013.01); H04L 41/0816 (2013.01); H04L 43/0876 (2013.01); H04L 63/1458 (2013.01)] 20 Claims
OG exemplary drawing
 
19. A method performed by a data-plane of a network device, the data-plane comprising two or more serial match-action circuitries that are configurable with match-action entries, the method comprising:
processing data tuples associated with received data messages using one or more match-action circuitries of the data-plane in order to forward data messages to either a next hop or to a control-plane circuit and
detecting a distributed denial of service (DDoS) attack, using one or more other match-action circuitries of the data-plane as a distributed DDoS attack detector, to detect a DDoS attack of a tracked set of one or more destinations, wherein identifiers of the tracked set of one or more destinations are identified by the control-plane circuit;
wherein:
the distributed DDoS attack detector is configurable to perform an iterative data collection process to iteratively collect attack related information with increasing granularity relative to initial granularity;
the iterative data collection process is for use in identifying a DDoS attack destination with increasing precision relative to initial precision;
the control-plane circuit is to set successive threshold levels associated with one or more tracked destination message flows related to the DDoS attack; and
the one or more tracked destination message flows are associated with the tracked set of one or more destinations.