TLS fingerprinting aids network operators to identify TLS clients running on the hosts communicating to their network. This helps them to identify vulnerable clients which could pose a security threat to their network in the future as they might have an underlying outdated TLS library. This information can be used by them to block or redirect the traffic. Existing software approaches cannot keep up with highspeed networks. This paper presents a P4-based programmable data plane implementation of TLS fingerprinting, based on JA3 scheme, and referred to as P4-TLSfp. P4-TLSfp runs on Tofino switches at line rate to perform fingerprinting and is used to identify the security profile of the clients. Experiments on packets collected from TLS/SSL clients running inside a campus network were conducted. The experimental results show that P4-TLSfp takes approximately 783 ns on the Intel Tofino switch translating to a throughput of$\mathbf{1. 3 2}$Mpps, whereas the JA3, implemented on server, takes approximately$300 \mu \mathrm{s}$.

Packet schedulers enable Programmable Data-plane (PDP) switches to schedule packets correctly according to their priority. Existing PDP implementations do not support priority-based scheduling mechanisms required by scheduling policies. Push-in First-out (PIFO) offers a priority queuing abstraction; however, it faces scalability challenges due to the need for packet sorting at line-rate. To address this, approximate schedulers trade scheduling accuracy for implementation simplicity, but suffer from priority inversions. This paper presents Parallel Processing for Priority Ordering (P3PO) architecture, which partitions a global priority queue into multiple smaller, independently sorted queues that operate concurrently. P3PO is implemented using the NetBench simulator, and its performance (FCTs, delays, packet drops) is measured for in-cast traffic patterns. P3PO has FCTs close to PIFO and performs 14-62% better compared to existing approaches for small-sized flows and 47-60% better for large-sized flows. P3PO also reduces the packet drops in the network by 66-95% across different flow sizes.

The increasing demand for low-latency, highthroughput packet processing has driven the exploration of programmable dataplane technologies such as P4 and eBPF/XDP. This paper evaluates the suitability of integrating P4 and XDP, which combines the flexible programmability of P4 running on a programmable data plane switch's pipeline and the expedited processing capabilities of Generic XDP running on the kernel of the hardware switch's CPU. The framework is implemented on the Tofino-1 switch for three different applications: forwarding, filtering and monitoring. The results show that P4+XDP performs similar to P4 in the simple forwarding application, but improves performance in filtering application, such as handling anomaly packets separately. This is attributed to XDP's kernel-bypass capabilities and proximity to the deparser in the Tofino-1 switch, enabling low-latency packet filtering. The studies also show that P4+XDP enhances packet processing by achieving an average latency reduction of 35 %, with values as low as 40 nanoseconds. It provides over 98% packet delivery due to its enhanced processing capability.

This paper deals with programmable data plane switches that perform flow classification using machine learning (ML) algorithms. This paper describes the implementation-based study of an existing ML-based packet marking scheme called FlowLens. The core algorithm, written in the P4 language, generates features, called flow markers, while processing packets. These flow markers are an efficient formulation of the packet length distribution of a particular flow. Secondly, a controller responsible for configuring the switch, extracting the features periodically, and applying machine learning algorithms for flow classification, is implemented in Python. The generation of flow markers is evaluated using flows in a tree-based topology in Mininet using the P4-enab1ed BMv2 packet switch on the mininet emulator. Classification is performed for the detection of two different types of network attacks: Active Wiretap and Mirai Botnet. In both cases, we obtain a 30-fold reduction in memory footprint with no loss in accuracy demonstrating the potential of running P4-based ML algorithms in packet switches.

The research community has been moving attention from Virtual Network Function (VNF) to Cloud-native Network Function (CNF) since cloudification has brought the Network Function Virtualization (NFV) to an advanced level. It has already been demonstrated that cloud-native technology brings high flexibility and efficiency to large-scale network service deployment compared to the traditional VNF with Virtual Machines (VMs). However, more work is needed to provide a flexible and reliable Service Function Chaining (SFC) development solution in a cloud-native environment. This paper proposes a web-based orchestrator system to deploy an SFC use case consisting of multiple CNFs in a multi-node Kubernetes cluster using Network Service Mesh (NSM). We demonstrate a cloud-native SFC framework that allows users to dynamically create container-based SFC rather than the traditional VMs with NFV/SDN controller approach. Further, additional work is presented with the support of an open-source monitoring system, Prometheus, to validate the SFC path.