FloodKiller: Leveraging P4 and eBPF to Defend Against Dynamic-Scale TCP Flooding Attacks

October 27, 2025

Distributed Denial-of-Service (DDoS) attacks continue to pose a major threat to the stability and availability of online services. Among these, SYN and ACK Flooding attacks remain particularly disruptive, exploiting weaknesses in the TCP connection establishment process to overwhelm servers with incomplete or out-of-context packets. As attack rates reach the terabit-per-second scale, conventional defenses relying on software-based filtering or external appliances struggle to keep pace, often degrading network performance or introducing significant latency for legitimate users. To address these limitations, this thesis presents FloodKiller, a high-performance defense system that leverages programmable switches to mitigate SYN and ACK Flooding attacks directly within the network data plane. FloodKiller exploits the switch’s line-rate packet processing capabilities to filter and validate connection attempts in real time, ensuring that only legitimate traffic reaches the server. Its design integrates three complementary components: an efficient in-switch SYN cookie generation mechanism for stateless verification, a flow tracking system for lightweight membership queries based on Bloom Filters, and a novel live connection migration mechanism that transfers verified connections to the server without sequence number translation or added latency. FloodKiller was implemented and evaluated on real Tofino hardware, demonstrating its ability to block 100% of attack traffic while maintaining minimal latency and negligible overhead for legitimate connections. Security analysis confirms its resilience against nonce deduction, replay, and resource exhaustion attacks. By combining in-network verification with dynamic connection migration, FloodKiller establishes a new architectural model for DDoS mitigation - one that bridges the gap between high-speed data-plane defenses and end-host compatibility.

Authors in the community:

• 

  S

  Sofia Morais Romeiro

  ist198968

Supervisors of this institution:

• 

  N

  Nuno Miguel Carvalho dos Santos

  ist14261

electrical-engineering-electronic-engineering-information-engineering - Electrical engineering, electronic engineering, information engineering

eng - English

Instituto Superior Técnico