Analysis of OVS Kernel Datapath Performance Collapse During DDoS Attacks and Mitigation

Random-pattern DDoS attacks undermine the traffic locality premise of the Open vSwitch (OVS) kernel datapath, causing performance collapse. The primary causes are threefold: Upcall Storm, Mask Explosion, and Cache Thrashing.

Performance Degradation Mechanisms

Upcall Storm occurs when random headers cause every packet to trigger a Flow Miss. The kernel must execute upcalls to userspace ovs-vswitchd via Generic Netlink, and the resulting context switches and Netlink serialization overhead cause throughput to plummet from millions of packets per second (Mpps) to tens of thousands of packets per second (Kpps).

Mask Explosion is the phenomenon where the complexity of kernel wildcard matching increases upon installing mitigation rules. The lookup time complexity of TSS (Tuple Space Search) increases to O(N) with the number of masks N, causing latency to increase linearly in proportion to the number of rules.

Cache Thrashing occurs when random packets cause hardware RSS to fluctuate, driving the O(1) success rate of per-CPU mask_cache close to 0%. The background rebalancer wastes CPU resources prioritizing hot masks and induces RCU synchronization overhead.

Response and Mitigation Strategies

To prevent performance collapse, defense must occur before packets reach the OVS ingress logic. The most efficient method is using XDP (Express Data Path) to block malicious traffic at the NIC driver level. Drop processing at the XDP stage bypasses memory allocation and the TSS engine, making it 10–20 times faster than drops within OVS.

In environments that do not support XDP, applying eBPF to the TC ingress hook or utilizing hardware offload via the NIC's flow director (ntuple filters) can block attack patterns without consuming CPU resources. Operators should monitor TSS efficiency (average mask checks per packet), the number of active masks, datapath miss rates, and cache hit rates using the ovs-dpctl show command to detect signs of attack.