Behavior Anomaly Detection in SDN Control Plane: A Case Study of Topology Discovery Attacks

Figure 2

LLDP frame format. The destination MAC address is a fixed set of MAC addresses 01-80-C2-00-00-0E. The source MAC address is the MAC address of the sending LLDP device. The LLDP ether-type code is 88-CC. The chassis ID TLV is the identification code of the switch; port ID TLV is the port number; TTL TLV records the lifetime of this LLDPDU; optional TLV is the selected TLV in the LLDPDU; and end of LLDPDU is used to inform the receiver the body of this LLDP has ended.