  Software-defined networking (SDN) eases network management by centralizing
the control plane and separating it from the data plane. The separation of
planes in SDN, however, introduces new vulnerabilities in SDN networks since
the difference in processing packets at each plane allows an adversary to
fingerprint the network's packet-forwarding logic. In this paper, we study the
feasibility of fingerprinting the controller-switch interactions by a remote
adversary, whose aim is to acquire knowledge about specific flow rules that are
installed at the switches. This knowledge empowers the adversary with a better
understanding of the network's packet-forwarding logic and exposes the network
to a number of threats. In our study, we collect measurements from hosts
located across the globe using a realistic SDN network comprising of OpenFlow
hardware and software switches. We show that, by leveraging information from
the RTT and packet-pair dispersion of the exchanged packets, fingerprinting
attacks on SDN networks succeed with overwhelming probability. We also show
that these attacks are not restricted to active adversaries, but can be equally
mounted by passive adversaries that only monitor traffic exchanged with the SDN
network. Finally, we discuss the implications of these attacks on the security
of SDN networks, and we present and evaluate an efficient countermeasure to
strengthen SDN networks against fingerprinting. Our results demonstrate the
effectiveness of our countermeasure in deterring fingerprinting attacks on SDN
networks.
