Measuring a Victim by Packet Rate

The OVS packet-rate attack asks a different question from header recovery: if a victim's packet contents remain hidden, can the shared switch still reveal how intensely the victim is communicating? The study answers that question by using megaflow subtable order as a remote measuring scale. The result is an approximate rate range, not an exact transcript. That distinction lets us judge what traffic metadata can disclose, why stable flows are easier to follow, and how the cache's update rhythm limits the inference.

Turning subtable order into a measuring scale

The attack again assumes a victim and a queryable service in separate VMs that share an OVS instance. The victim accesses a service outside the host whose address, port, and protocol are known to the attacker. The attacker can query a service co-located with the victim and can use that path to observe OVS behavior. The victim is not sending packets to the attacker. Instead, the victim's traffic changes the activity counts associated with a megaflow rule, and the attacker measures the resulting position of that rule relative to reference rules.

The relevant megaflow behavior is sequential lookup. Each subtable contains rules with a common mask, and OVS checks subtables in order until one matches the packet. A subtable that moves toward the front requires fewer preceding checks. A subtable that remains near the back requires more. Since OVS periodically reorders subtables according to hit counts, access frequency becomes a factor in lookup latency.

The attacker turns that relationship into a set of thresholds. Several reference subtables receive controlled traffic at known rates. In the paper's example, four threshold subtables are assigned different rates, with padding subtables placed between them so that the reference positions remain distinguishable. The thresholds form an ordered scale: a subtable receiving more traffic should be nearer the front, while one receiving less should be farther back. The victim-related subtable is then compared with those reference positions.

The comparison is not a direct packet counter. The attacker sends probes and measures the round-trip time associated with the victim's subtable and the threshold subtables. If the victim-related subtable sits between two references, the attacker infers that the victim's traffic rate falls between the corresponding threshold rates. The output is an interval. It is useful precisely because it preserves an ordering relationship even when the attacker cannot see the packet stream itself.

There is a dependency between the two OVS caches. Victim traffic that remains a microflow hit may not reach the megaflow cache often enough to change the subtable counts the attacker is trying to observe. The study therefore arranges for the victim flow to be evicted from microflow so that its packets exercise the megaflow path. This is not a claim that all packet-rate monitoring requires identical eviction traffic in every deployment. It illustrates the tested attack's need to expose the megaflow state rather than let the first cache absorb the signal.