Portest: Port Scan Detection on Non-Programmable Switches using TCAM and Randomized Algorithm

Monitoring network traffic for detecting security events is crucial for the effective operation of intrusion detection systems (IDS). While programmable switches offer the flexibility to execute monitoring algorithms directly in the data plane, non-programmable switches lack such capabilities and traffic needs to be mirrored and processed externally, leading to scalability and performance challenges. In this paper, we present Portest, a novel algorithm that enables the detection of port scans on non-programmable switches without mirroring traffic. Portest installs a constant number of flow rules with specific stochastic properties in the Ternary Content Addressable Memory (TCAM) of the switch and uses the match counter values for detection. Our results demonstrate that Portest can efficiently detect real-world port scans on non-programmable hardware.