Attacking the Hash Table based Data Structures of Flow Monitors

Aggregation modules within flow-based network monitoring tools make use of fast lookup methods to be able to quickly assign received packets to their corresponding flows. In software-based aggregators, hash tables are usually used for this task, as these offer constant lookup times under optimal conditions. The hash functions used for mapping flow keys to hash values need to be chosen carefully to ensure optimal utilization of the hash table. If attackers are able to create collisions, the hash table degenerates to linked lists with worst-case lookup times of O(n) and greatly reduce the performance of the aggregation modules. In this report, we analyze the aggregation modules of software-based flow meters Vermont and nProbe. We evaluate the resilience strength of used hash functions by theoretical analysis and confirm the results by performing real attacks.