OpenPenny: Identifying Legitimate Traffic to Reduce Monitoring Noise#

Petros Gigis, UCL

• Why: Fills a real gap in ISP observability: packet counters and control-plane data can't tell you whether observed traffic is genuine or spoofed — which makes routing-change alerts noisy and stealthy hijacks hard to confirm.
• What: An open-source data-plane primitive that validates whether traffic aggregates are non-spoofed, enabling trustworthy ingress maps, fewer false routing alerts, and detection of data-plane path anomalies invisible to BGP monitoring alone (including ROV-bypassing "stealthy hijacks" where the only visible signal is an unexpected ingress point).
• How: Exploits a structural difference between real and spoofed TCP: legitimate connections are closed-loop (loss triggers retransmission), spoofed traffic is open-loop and cannot react. Active mode carefully drops a few packets and watches for retransmission; passive mode collects signals (e.g., per-packet load-balancing behavior) without touching traffic. Runs on commodity x86 using XDP/AF_XDP and DPDK; demonstrated on a real UCL testbed.
• Where applicable: ISPs and large network operators with sFlow/NetFlow telemetry; the active mode injects small, deliberate loss, so it suits telemetry/monitoring paths rather than every production link. Solidly in the eBPF/XDP space the PM tracks.