With increasing network bandwidths, stateful firewalls are likely to become communication bottlenecks in networks. To mitigate this problem, we propose to bypass selected traffic around firewalls using software-defined networking (SDN). We discuss various approaches and elaborate the following concept. A controller samples outgoing packets at the firewall using sFlow to detect congestion. In case of congestion, flows already admitted by the firewall are identified and offloaded at an appropriate rate by installing flow-specific bypass rules on an OpenFlow-capable switch. We suggest two different algorithms to select appropriate flows and provide a proof-of-concept implementation in a network testbed using the Ryu controller framework. Experimental results illustrate the system behavior at different load levels with and without offloading. We provide an analytical system model to predict the offloading performance for other system parameters than experimentally evaluated and validate the model with our experimental results. A parameter study suggests that the offloaded traffic rate may be a multiple of the firewall's capacity if the switch supports sufficient flow rules or is able to match for TCP flags.

C-DAX is a cyber-secure publish/subscribe middleware tailored to the needs of smart grids, offering end-to-end security, and scalable and resilient communication among participants in a smart grid. While C-DAX' broker-based publish/subscribe mechanisms are well-suited for scalable information dissemination with regard to high numbers of publishers and subscribers, (1) additional transmission delays are inherent to the design because of multi-hop application layer forwarding, and (2) interactive (probably legacy) applications are prohibited due to the one-way publish/subscribe paradigm and potential dependencies on IP communication. This work presents two advanced communication modes for the C-DAX architecture, addressing those issues: (1) broker-less publish/subscribe for delay-sensitive applications, and (2) transparent IP-tunneling over publish/subscribe for legacy applications. Those modes further improve C-DAX' suitability for smart grid applications, including enhanced real-time application support, and transparent support for legacy smart grid communication protocols.

IEEE C37.118 is the current standard for synchrophasor measurements in power systems. It defines the measurement method and communication protocols for the entities in a synchrophasor network. The standard offers two different modes for client-server communication, but cannot be used unchanged over publish/subscribe communication architectures, whose major advantage is simplified and incremental integration of new applications. This work reviews the communication part of IEEE C37.118, and provides an adapter-based solution to easily connect and integrate entities in a synchrophasor network over a publish/subscribe communication architecture. The proposed adapters offer standard-compliant communication between the synchrophasor measurement network entities to facilitate the exchange of measurement data.

This demo presents a testbed for computer networking education. It leverages hardware virtualization to accommodate 6 PCs and 2 routers on a single testbed host to reduce costs, energy consumption, space requirements, and heat emission. The testbed excels by providing dedicated physical Ethernet and USB interfaces for virtual machines so that students can interconnect them with cables and switches like in a non-virtualized testbed