As network programmability promotes increasingly intelligent hosts, NICs, and switches, we argue that the next frontier lies in making the cables themselves smarter. By embedding lightweight, wire-speed processing directly within transceivers, we enable precise, low-latency, and energy-efficient network functions, providing a modular and cost-effective path to extend the life of legacy infrastructure and to fundamentally rethink where intelligence belongs in the data plane. To concretize such vision, this paper introduces FlexSFP, a programmable variant of the standard SFP+ transceiver, embedding lightweight FPGA-based logic for in-line packet processing. Driven by both technical and economic considerations, FlexSFP offers a compelling "cheap path" alongside host CPUs and SmartNICs, enabling targeted acceleration where cost, power, and deployment flexibility are critical. We explore practical use cases, such as per-port firewalling, in-line telemetry, and retrofitting legacy switches, and outline a feasible architecture and programming model.

This demo paper experimentally explores the feasibility of full-frame meaconing attacks in 5th generation (5G) systems, wherein adversaries stealthily manipulate time-of-arrival (ToA) measurements without disrupting ongoing communications. By intercepting, delaying, and amplifying the entire 5G frames, including critical positioning signals from the gNodeB (gNB), the attack injects a bias into the ToA estimation process, leading to significant positioning errors while leaving the communication service uninterrupted. Our evaluation, conducted on a comprehensive end-to-end 5G testbed built with commercial-off-the-shelf (COTS) and Software-Defined Radio (SDR) devices, includes real-time monitoring of key performance metrics such as reference signal received power (RSRP) and signal to interference and noise ratio (SINR). The experimental results highlight a critical physical-layer vulnerability in 5G positioning, underscoring the urgent need for robust countermeasures to safeguard network integrity.

While extensively studied in Global Positioning Systems, meaconing—i.e., the delay, amplification, and replay of a signal—is often regarded as impractical in cellular positioning systems due to the potential risk of communication disruption. We challenge this belief by experimentally validating full-frame meaconing attacks on 5G systems. Using off-the-shelf hardware, we demonstrate how an attacker can replay entire 5G frames, introducing o(μs) controlled TOA biases while maintaining uninterrupted communication. Our findings reveal the real world viability of these attacks, highlighting the urgent need for robust countermeasures to protect 5G localization systems.

Distributed Denial of Service (DDoS) attacks pose a significant threat to the stability and availability of online services. An effective strategy for mitigating these attacks involves the decentralization of filtering mechanisms, which enhances resilience by distributing the load and reducing single points of failure. However, the deployment of decentralized filters presents challenges in terms of ease of deployment, performance, and scalability. To address these challenges, this study proposes the utilization of extended Berkeley Packet Filter (eBPF) for coding the filters and eHDL for hardware offloading. Our solution leverages the flexibility of eBPF for rapid development and deployment of complex filtering logic, while eHDL facilitates the efficient translation of these filters into hardware configurations capable of operating at the network speed. We demonstrate the effectiveness of our approach by offloading four distinct eBPFbased DDoS prevention applications, including two previously proposed in scholarly literature, and validate the scalability of our system up to 100 Gbps. This proof-of-concept underscores the potential of combining eBPF and eHDL to create robust, scalable, and high-performance DDoS protection architectures.

Scaling network packet processing performance to meet the increasing speed of network ports requires software programs to carefully leverage the network devices’ hardware features. This is a complex task for network programmers, who need to learn and deal with the heterogeneity of device architectures, and re-think their software to leverage them. In this paper we make first steps to reverse this design process, enabling the automatic generation of tailored hardware designs starting from a network packet processing program. We introduce eHDL, a high-level synthesis tool that automatically generates hardware pipelines from unmodified Linux’s eBPF/XDP programs. eHDL is designed to enable software developers to directly define and implement the hardware functions they need in the NIC. We prototype eHDL targeting a Xilinx Alveo U50 FPGA NIC, and evaluate it with a set of 5 eBPF/XDP programs. Our results show that the generated pipelines are efficient in terms of required hardware resources, using only 6.5%-13.3% of the FPGA, and always achieve the line rate forwarding throughput with about 1 microsecond of per-packet forwarding latency. Compared to other network-specific high-level synthesis tool, eHDL enables software programmers with no hardware expertise to describe stateful functions that operate on the entire packet data. Compared to alternative processor-based solutions that perform eBFP/XDP offloading to a NIC, eHDL provides 10-100x higher throughput.