Simple solution

[arkgil]

Alright, so this seems to be working solution for our problem. It is based on our first idea to ask switch about flow statistics. It may be a little naive and definietly not scalable but it does its job:) Please comment and let me know if there is anything what could be improved in your opinion 👍

[mentels]

This one won't be merged as I decided to pull an other solution. Anyway, an interesting thing to see would be to get rid of periodically sending flows_stats_request and instead rely on flow_removed message. In more detail: we could simply subscribe to this message and check the counters of a flow in the flow_removed message. According to the 7.4.2 chapter in the spec, all the counters are sent along the flow_removed message. This message is only sent when it is explicitly configured on the switch (see 7.3.10). I'm going to check how we can configure that in the OVS.

I think that having another option for managing our simple IDS algorithm would be great! Then we can compare 2 approaches.

I think that the best option is to integrate that with the solution from @mbSmaga by extracting common logic to sth like common_ids and then adding to separate, alternative modules.