arXiv subjects

Michael Menth

Publications and source records attributed to Michael Menth.

At least 19 recordsLinked to original sources

arXiv2026

Performance Evaluation of Selection Strategies for Inter-Satellite Paths in Walker-Delta Constellations

In LEO satellite constellations, traffic between a user terminal and a gateway is carried over a satellite path. As the satellite constellation rotates around Earth, a new path must be reselected repeatedly from a set of path candidates. In this paper, we study the impact of path selection strategies on several metrics: path length in terms of Euclidean distance and hop count, path-change rate, and rate of used links. These metrics are relevant because they affect either communication latency or the complexity of control and resource management. We explain how path candidates are generated, define three heuristic path selection strategies, and evaluate them over a large set of UT-GW scenarios within a single shell of a Walker-Delta constellation with 1,156 satellites. Overall, the results show that path selection has a significant impact on both latency-related metrics and path churn.

cs.NI↗

arXiv2026

DPDS: A DPDK-Based Packet Delayer and Spacer

In this paper we tackle the problem of adding varying delay to packets for link emulation. Naive approaches either add more delay than desired or cause packet reordering, both of which are undesirable. We develop adaptive delay correlation, which adds positively correlated delays to packets efficiently. It takes a mean delay and standard deviation (jitter) as input, as well as a half-life period to control the delay dynamics. We investigate the accuracy and dynamics of the resulting packet delays with and without bandwidth limitation. As a result we give a recommendation for the configuration of the half-life period. We implement adaptive delay correlation in a DPDK-based packet delayer and spacer (DPDS), investigate its performance on hardware, and compare it with the widely used link emulator NetEm and the recently developed DPDK-based emulator MoonEm. DPDS outperforms both of them with a zero-loss throughput of 95 Gbit/s for constant delay and, with spacing enabled, 85 Gbit/s for varying delay with 3 ms jitter. Further, DPDS supports packet reordering with zero-loss throughputs of 73 Gbit/s and 58 Gbit/s for constant and varying delay, respectively, as well as policing and two packet loss models.

cs.NI↗

arXiv2026

High-Speed Generation of Periodic Traffic Patterns on P4TG for DDoS and Burst-Load Evaluation

Traffic generators are essential tools for evaluating the robustness and performance of networked systems. P4TG is an open-source, hardware-accelerated traffic generator implemented in P4 for the Intel Tofino ASIC. It has been adopted by researchers and industry due to its flexibility and multi-terabit generation capability, and its low cost compared to other traffic generators. However, like most existing generators, it primarily produces constant bit rate traffic, which does not reflect the highly time-varying behavior observed in real networks, such as flashcrowds and microbursts. Such patterns are difficult to emulate at scale with current tools. We present a data plane mechanism for P4TG that shapes periodic, time-varying traffic patterns, including patterns representative of DDoS attacks and burst-load scenarios. Pattern shaping in P4TG can be applied to its generated traffic at an aggregate throughput of up to 4 Tbit/s. We evaluate pattern accuracy and analyze scalability across different sampling resolutions and periods. Further, we demonstrate practical use cases, including zero-loss throughput determination and buffer capacity measurement. Finally, we present microburst-based attack scenarios that overload UDP receivers, switch buffers, and degrade TCP throughput on shared links while remaining undetectable to conventional rate monitoring.

cs.NI↗

arXiv2026

Assessing the Real-World Impact of Post-Quantum Cryptography on WPA-Enterprise Networks

The advent of large-scale quantum computers poses a significant threat to contemporary network security protocols, including Wi-Fi Protected Access (WPA)-Enterprise authentication. To mitigate this threat, the adoption of Post-Quantum Cryptography (PQC) is critical. In this work, we investigate the performance impact of PQC algorithms on WPA-Enterprise-based authentication. To this end, we conduct an experimental evaluation of authentication latency using a testbed built with the open-source tools FreeRADIUS and hostapd, measuring the time spent at the client, access point, and RADIUS server. We evaluate multiple combinations of PQC algorithms and analyze their performance overhead in comparison to currently deployed cryptographic schemes. Beyond performance, we assess the security implications of these algorithm choices by relating authentication mechanisms to the quantum effort required for their exploitation. This perspective enables a systematic categorization of PQ-relevant weaknesses in WPA-Enterprise according to their practical urgency. The evaluation results show that, although PQC introduces additional authentication latency, combinations such as ML-DSA-65 and Falcon-1024 used in conjunction with ML-KEM provide a favorable trade-off between security and performance. Furthermore, we demonstrate that the resulting overhead can be effectively mitigated through session resumption. Overall, this work presents a first real-world performance evaluation of PQC-enabled WPA-Enterprise authentication and demonstrates its practical feasibility for enterprise Wi-Fi deployments.

cs.CR↗

arXiv2025

P4-TAS: P4-Based Time-Aware Shaper for Time-Sensitive Networking

Time-sensitive networking (TSN) is a set of IEEE standards that extends Ethernet with real-time capabilities. Among its mechanisms, the time-aware shaper (TAS) periodically opens and closes egress queues to protect scheduled traffic from lower-priority flows, ensuring low latency and bounded delay. Deterministic networking (DetNet), standardized by the IETF, provides similar guarantees at Layer 3 and can leverage TSN mechanisms such as the TAS. Commercially available TSN-capable switches implement TAS in hardware but rarely disclose internal delays in the TAS mechanism itself. Such delays directly affect scheduling precision, yet information about them is largely unavailable to system designers. In this work, we present P4-TAS, a P4-based implementation of the TAS on the Intel Tofino 2 switching ASIC that additionally supports per-stream filtering and policing (PSFP) and PTP time synchronization. First, we design a novel mechanism for periodic queue control that uses a continuous stream of internally generated control frames for time-triggered queue state updates. To the best of our knowledge, this enables TAS on a P4-programmable ASIC for the first time. P4-TAS additionally provides an MPLS/TSN translation layer that enables TSN time-based shaping to be applied at the boundary between TSN and DetNet domains, supporting line rates up to 400 Gb/s per port. Second, we identify and quantify three sources of internal delay that affect the precision of TAS gate transitions, providing transparency that enables more accurate TAS configuration. Our evaluation demonstrates a worst-case accumulated internal delay of 86 ns between time slices, which is well below values reported for commercial switches. Third, we propose a measurement methodology to externally measure TAS time slice accuracy, and introduce gate switching intervals (GSIs) to mitigate overlap between consecutive time slices.

cs.NI↗

arXiv2025

Impact of Packet Loss and Timing Errors on Scheduled Periodic Traffic with Time-Aware Shaping (TAS) in Time-Sensitive Networking (TSN)

Time-Sensitive Networking (TSN) is a collection of mechanisms to enhance the realtime transmission capability of Ethernet networks. TSN combines priority queuing, traffic scheduling, and the Time-Aware Shaper (TAS) to carry periodic traffic with ultra-low latency and jitter. That is, so-called Talkers send periodic traffic with highest priority according to a schedule. The schedule is designed such that the scheduled traffic is forwarded by the TSN bridges with no or only little queuing delay. To protect that traffic against other frames, the TAS is configured on all interfaces such that lower-priority queues can send only when high-priority traffic is not supposed to be forwarded. In the literature on scheduling algorithms for the TAS there is mostly the explicit or implicit assumption that the TAS also limits transmission slots of high-priority traffic. In this paper we show that this assumption can lead to tremendous problems like very long queuing delay or even packet loss in case of faulty frames. A faulty frame arrives too early or too late according to the schedule, it is missing or additional. We construct minimal examples to illustrate basic effects of faulty frames on a single link and demonstrate how this effect can propagate through the networks and cause remote problems. We further show using simulations that a single slightly delayed frame may lead to frame loss on multiple links. We show that these problems can be alleviated or avoided when TAS-based transmission slots for high-priority traffic are configured longer than needed or if they are not limited at all.

cs.NI↗

arXiv2025

A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language Models

The increasing adoption of Large Language Models (LLMs) in software engineering has sparked interest in their use for software vulnerability detection. However, the rapid development of this field has resulted in a fragmented research landscape, with diverse studies that are difficult to compare due to differences in, e.g., system designs and dataset usage. This fragmentation makes it difficult to obtain a clear overview of the state-of-the-art or compare and categorize studies meaningfully. In this work, we present a comprehensive systematic literature review (SLR) of LLM-based software vulnerability detection. We analyze 263 studies published between January 2020 and November 2025, categorizing them by task formulation, input representation, system architecture, and techniques. Further, we analyze the datasets used, including their characteristics, vulnerability coverage, and diversity. We present a fine-grained taxonomy of vulnerability detection approaches, identify key limitations, and outline actionable future research opportunities. By providing a structured overview of the field, this review improves transparency and serves as a practical guide for researchers and practitioners aiming to conduct more comparable and reproducible research. We publicly release all artifacts and maintain a living repository of LLM-based software vulnerability detection studies at https://github.com/hs-esslingen-it-security/Awesome-LLM4SVD.

cs.SE↗

arXiv2025

Stack Management for MPLS Network Actions: Integration of Nodes with Limited Hardware Capabilities

The MPLS Network Actions (MNA) framework enhances MPLS forwarding with a generalized encoding for manifold extensions such as network slicing and in-situ OAM (IOAM). Network actions in MNA are encoded in Label Stack Entries (LSEs) and are added to the MPLS stack. Routers have a physical limit on the number of LSEs they can read, called the readable label depth (RLD). With MNA, routers must be able to process a minimum number of LSEs which requires a relatively large RLD. In this paper, we perform a hardware analysis of an MNA implementation and identify the reason for a large RLD requirement in the MNA protocol design. Based on this, we present a mechanism that reduces the required RLD for MNA nodes by restructuring the MPLS stack during forwarding. We then introduce the novel stack management network action that enables the proposed mechanism as well as its integration in networks with MNA-incapable nodes. The feasibility of the mechanism on programmable hardware is verified by providing a P4-based implementation. Further, the effects on the required RLD, ECMP, and packet overhead are discussed.

cs.NI↗

arXiv2025

Enhancements to P4TG: Histogram-Based RTT Monitoring in the Data Plane

Modern traffic generators are essential tools for evaluating the performance of network environments. P4TG is a P4-based traffic generator implemented for Intel Tofino switches that offers high-speed packet generation with fine-grained measurement capabilities. However, P4TG samples time-based metrics such as the round-trip time (RTT) in the data plane and collects them at the controller. This leads to a reduced accuracy. In this paper, we introduce a histogram-based RTT measurement feature for P4TG. It enables accurate analysis at line rate without sampling. Generally, histogram bins are modeled as ranges, and values are matched to a bin. Efficient packet matching in hardware is typically achieved using ternary content addressable memory (TCAM). However, representing range matching rules in TCAM poses a challenge. Therefore, we implemented a range-to-prefix conversion algorithm that models range matching with multiple ternary entries. This paper describes the data plane implementation and runtime configuration of RTT histograms in P4TG. Further, we discuss the efficiency of the ternary decomposition. Our evaluation demonstrates the applicability of the histogram-based RTT analysis by comparing the measured values with a configured theoretical distribution of RTTs.

cs.NI↗

arXiv2025

Packet Level Resilience for the User Plane in 5G Networks

The growing demands of ultra-reliable and low-latency communication (URLLC) in 5G networks necessitate enhanced resilience mechanisms to address user plane failures caused by outages, hardware defects, or software bugs. An important aspect for achieving ultra-reliable communication is the redundant transmission of packets, as also highlighted in 3GPP Release 18. This paper explores leveraging the Packet Replication, Elimination, and Ordering Function (PREOF) to achieve 1+1 path protection within private 5G environments. By extending existing 5G components with mechanisms for packet level redundancy and offloading the reordering mechanism to external servers, the proposed approach ensures minimal packet loss in case of a failure. A conceptual integration of redundant paths and programmable elements is presented, with considerations for deployment in existing 5G infrastructures and the trade-offs of latency versus enhanced traffic engineering. Future work aims to evaluate practical implementations using an open source 5G core, P4-based hardware and offloading technologies like DPDK and eBPF.

cs.NI↗

arXiv2025

Enhancements to P4TG: Protocols, Performance, and Automation

P4TG is a hardware-based traffic generator (TG) running on the Intel Tofino 1 ASIC and was programmed using the programming language P4. In its initial version, P4TG could generate up to 10x100 Gb/s of traffic and directly measure rates, packet loss, and other metrics in the data plane. Many researchers and industrial partners requested new features to be incorporated into P4TG since its publication in 2023. With the recently added features, P4TG supports the generation of packets encapsulated with a customizable VLAN, QinQ, VxLAN, MPLS, and SRv6 header. Further, generation of IPv6 traffic is added and P4TG is ported to the Intel Tofino 2 platform enabling a generation capability of up to 10x400 Gb/s. The improvement in user experience focuses on ease of operation. Features like automated ARP replies, improved visualization, report generation, and automated testing based on the IMIX distribution and RFC 2544 are added. Future work on P4TG includes NDP to facilitate IPv6 traffic, and a NETCONF integration to further ease the configuration.

cs.NI↗

arXiv2025

Rust Barefoot Runtime (RBFRT): Fast Runtime Control for the Intel Tofino

Data plane programming enables the programmability of network devices with domain-specific programming languages, like P4. One commonly used P4-programmable hardware target is the Intel Tofino switching ASIC. The runtime behavior of an implemented P4 program on Tofino can be configured with shell scripts or a Python library from Barefoot provided with the Tofino. Both are limited in their capabilities and usability. This paper introduces the Rust Barefoot Runtime (RBFRT), a Rust-based control plane library. The RBFRT provides a fast and memory-safe interface to configure the Intel Tofino. We showed that the RBFRT achieves a higher insertion rate for MAT entries and has a shorter response time compared to the Python library.

cs.NI↗

arXiv2025

Streamlining Plug-and-Charge Authorization for Electric Vehicles with OAuth2 and OIDC

The Plug-and-Charge (PnC) process defined by ISO 15118 standardizes automated Electric Vehicle (EV) charging by enabling automatic installation of credentials and use for authentication between EV and Charge Point (CP). However, the current credential installation process is non-uniform, relies on a complex Public Key Infrastructure (PKI), lacks support for fine-grained authorization parameters, and is not very user-friendly. In this paper, we propose a streamlined approach to the initial charging authorization process by leveraging the OAuth Device Authorization Grant and Rich Authorization Requests. The proposed solution reduces technical complexity, simplifies credential installation, introduces flexible authorization constraints (e.g., time- and cost-based), and facilitates payment through OpenID Connect (OIDC). We present a proof-of-concept implementation along with performance evaluations and conduct a symbolic protocol verification using the Tamarin prover. Furthermore, our approach solves the issue of OAuth's cross-device authorization, making it suitable as a formally proven blueprint in contexts beyond EV charging.

cs.CR↗

arXiv2024

MPLS Network Actions: Technological Overview and P4-Based Implementation on a High-Speed Switching ASIC

In MPLS, packets are encapsulated with labels that add domain-specific forwarding information. Special purpose labels were introduced to trigger special behavior in MPLS nodes but their number is limited. Therefore, the IETF proposed the MPLS Network Actions (MNA) framework. It extends MPLS with new features, some of which have already been defined to support relevant use cases. This paper provides a comprehensive technological overview of MNA concepts and use cases. It compares MNA to IPv6 extension headers (EHs) that serve a similar purpose, and argues that MNA can be better deployed than EHs. It then presents P4-MNA, a first hardware implementation running at 400 Gb/s per port. Scalability and performance of P4-MNA are evaluated, showing negligible impact on processing delay caused by network actions. Moreover, the applicability of MNA is demonstrated by implementing the use cases of link-specific packet loss measurement using the alternate-marking-method (AMM) and bandwidth reservation using network slicing. We identify header stacking constraints resulting from hardware resources and from the number of network actions that must be supported according to the MNA encoding. They make an implementation for hardware that can only parse a few MPLS headers infeasible. We propose to make the number of supported network actions a node parameter and signal this in the network. Then, an upgrade to MNA is also feasible for hardware with fewer available resources. We explain that for MNA with in-stack data (ISD), some header bits must remain unchanged during forwarding, and give an outlook on post-stack data (PSD).

cs.NI↗

arXiv2024

Extensions to BIER Tree Engineering (BIER-TE) for Large Multicast Domains and 1:1 Protection: Concept, Implementation and Performance

Bit Index Explicit Replication (BIER) has been proposed by the IETF as a stateless multicast transport technology. BIER adds a BIER header containing a bitstring indicating receivers of an IP multicast (IPMC) packet within a BIER domain. BIER-TE extends BIER with tree engineering capabilities, i.e., the bitstring indicates both receivers as well as links over which the packet is transmitted. As the bitstring is of limited size, e.g., 256 bits, only that number of receivers can be addressed within a BIER packet. To scale BIER to larger networks, the receivers of a BIER domain have been assigned to subsets that can be addressed by a bitstring with a subset ID. This approach is even compliant with fast reroute (FRR) mechanisms for BIER. In this work we tackle the challenge of scaling BIER-TE to large networks as the subset mechanism of BIER is not sufficient for that purpose. A major challenge is the support of a protection mechanism in this context. We describe how existing networking concepts like tunneling, egress protection and BIER-TE-FRR can be combined to achieve the goal. Then, we implement the relevant BIER-TE components on the P4-programmable Tofino ASIC which builds upon an existing implementation for BIER. Finally, we consider the forwarding performance of the prototype and explain how weaknesses can be improved from remedies that are well-known for BIER implementations.

cs.NI↗

arXiv2024

Autonomous Integration of TSN-unaware Applications with QoS Requirements in TSN Networks

Modern industrial networks transport both best-effort and real-time traffic. Time-Sensitive Networking (TSN) was introduced by the IEEE TSN Task Group as an enhancement to Ethernet to provide high quality of service (QoS) for real-time traffic. In a TSN network, applications signal their QoS requirements to the network before transmitting data. The network then allocates resources to meet these requirements. However, TSN-unaware applications can neither perform this registration process nor profit from TSN's QoS benefits. The contributions of this paper are twofold. First, we introduce a novel network architecture in which an additional device autonomously signals the QoS requirements of TSN-unaware applications to the network. Second, we propose a processing method to detect real-time streams in a network and extract the necessary information for the TSN stream signaling. It leverages a Deep Recurrent Neural Network (DRNN) to detect periodic traffic, extracts an accurate traffic description, and uses traffic classification to determine the source application. As a result, our proposal allows TSN-unaware applications to benefit from TSNs QoS guarantees. Our evaluations underline the effectiveness of the proposed architecture and processing method.

cs.NI↗

arXiv2023

P4-PSFP: P4-Based Per-Stream Filtering and Policing for Time-Sensitive Networking

Time-Sensitive Networking (TSN) extends Ethernet to enable real-time communication. In TSN, bounded latency and zero congestion-based packet loss are achieved through mechanisms such as the Credit-Based Shaper (CBS) for bandwidth shaping and the Time-Aware Shaper (TAS) for traffic scheduling. Generally, TSN requires streams to be explicitly admitted before being transmitted. To ensure that admitted traffic conforms with the traffic descriptors indicated for admission control, Per-Stream Filtering and Policing (PSFP) has been defined. For credit-based metering, well-known token bucket policers are applied. However, time-based metering requires time-dependent switch behavior and time synchronization with sub-microsecond precision. While TSN-capable switches support various TSN traffic shaping mechanisms, a full implementation of PSFP is still not available. To bridge this gap, we present a P4-based implementation of PSFP on a 100 Gb/s per port hardware switch. We explain the most interesting aspects of the PSFP implementation whose code is available on GitHub. We demonstrate credit-based and time-based policing and synchronization capabilities to validate the functionality and effectiveness of P4-PSFP. The implementation scales up to 35840 streams depending on the stream identification method. P4-PSFP can be used in practice as long as appropriate TSN switches lack this function. Moreover, its implementation may be helpful for other P4-based hardware implementations that require time synchronization.

cs.NI↗

arXiv2023

$OIDC^2$: Open Identity Certification with OpenID Connect

OpenID Connect (OIDC) is a widely used authentication standard for the Web. In this work, we define a new Identity Certification Token (ICT) for OIDC. An ICT can be thought of as a JSON-based, short-lived user certificate for end-to-end user authentication without the need for cumbersome key management. A user can request an ICT from his OpenID Provider (OP) and use it to prove his identity to other users or services that trust the OP. We call this approach $OIDC^2$ and compare it to other well-known end-to-end authentication methods. Unlike certificates, $OIDC^2$ does not require installation and can be easily used on multiple devices, making it more user-friendly. We outline protocols for implementing $OIDC^2$ based on existing standards. We discuss the trust relationship between entities involved in $OIDC^2$, propose a classification of OPs' trust level, and propose authentication with multiple ICTs from different OPs. We explain how different applications such as videoconferencing, instant messaging, and email can benefit from ICTs for end-to-end authentication and recommend validity periods for ICTs. To test $OIDC^2$, we provide a simple extension to existing OIDC server software and evaluate its performance.

cs.CR↗