Implementing Adaptive Cuckoo Firewall for Programmable Switch

Abstract

Stateful firewalls are a critical security function in many networks. To implement a faster stateful firewall using high-speed programmable switch and support a large number of connections, we need to avoid the memory footprint of storing full 5-tuples. We store shorter hash digests in switch memory, while mitigating the effect of false positives by applying adaptations. We present a stateful firewall implementation on programmable switches, as well as design choices and benchmarks for adapting to false positives using cuckoo filters.