摘要： Software-de?ned networking (SDN) eases network management by centralizing the control plane and separating it from the data plane. The separation of planes in SDN, however, introduces new vulnerabilities in SDN networks, since the difference in processing packets at each plane allows an adversary to ?ngerprint the network’s packet-forwarding logic. In this paper, we study the feasibility of ?ngerprinting the controller-switch interactions by a remote adversary, whose aim is to acquire knowledge about speci?c ?ow rules that are installed at the switches. This knowledge empowers the adversary with a better understanding of the network’s packet-forwarding logic and exposes the network to a number of threats. In this paper, we collect measurements from hosts located across the globe using a realistic SDN network comprising of OpenFlow hardware and software switches. We show that, by leveraging information from the RTT and packet-pair dispersion of the exchanged packets, ?ngerprinting attacks on SDN networks succeed with overwhelming probability. We additionally show that these attacks are not restricted to active adversaries, but can also be mounted by passive adversaries that only monitor traf?c exchanged with the SDN network. Finally, we discuss the implications of these attacks on the security of SDN networks, and we present and evaluate an ef?cient countermeasure to strengthen SDN networks against ?ngerprinting. Our results demonstrate the effectiveness of our countermeasure in deterring ?ngerprinting attacks on SDN networks.