Lesson S4 · Special topics

Software-defined networking

Every switch and router does two jobs: deciding where traffic should go (the control plane) and moving each packet out of the right port (the data plane). Software-defined networking moves the deciding into one program, the controller, which writes rows into each switch's flow table. Watch the first packet miss, the controller answer with OpenFlow messages, the switches forward on their own, and a firewall app block telnet through the northbound API.

10 min11 steps5 questionsBeginner

Fig S4 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Which job does SDN take out of the switches and put into the controller?

The controller does the deciding for every switch. The switches keep the fast forwarding job and simply follow the rows the controller writes.

02Switch 1 has two rows that both match a telnet packet: priority 100 'output:2' and priority 200 'drop'. What happens?

An OpenFlow switch uses only the matching row with the highest priority. 200 beats 100, and a row with no actions drops the packet.

03A packet matches no row except the table-miss row (priority 0). What does the switch do?

The table-miss row matches anything with the lowest priority. Its action is commonly 'send to the controller', which then decides and writes a proper row with FLOW_MOD.

04A firewall app tells the controller 'block telnet to host B'. Which side of the controller is that?

Apps talk to the controller on its northbound side, saying what they want. The controller then talks southbound, for example with OpenFlow, to change the switches.

05What is a main cost of putting all control in one controller?

If the controller is down, no new rows can be written. Production controllers run as several copies, and the control channel must be protected.

Key terms

Glossary

Control plane: The part of a network that decides where traffic should go: learning the map and building the tables.
Data plane: The part that forwards each packet out of the right port, very fast, by looking it up in a table. Also called the forwarding plane.
SDN controller: A program, on an ordinary server, that runs the control plane for many switches and writes their forwarding rules.
OpenFlow: A southbound protocol (ONF) a controller uses to read and write switches' flow tables, over TCP port 6653.
Flow table: A switch's list of rows. Each row has match fields, a priority and actions; the matching row with the highest priority is used.
Table miss: When a packet matches no normal row. The table-miss row (priority 0, matches anything) usually sends it to the controller.
Northbound API: The interface apps use to tell the controller what they want, often a REST API. Southbound is controller to switches.
SD-WAN: Software-defined WAN: a central controller sets, per app, which link each site uses between offices (MEF 70).

Fine print

Notes and sources

Hosts use the private network 192.168.1.0/24 and the switches and controller a separate private control network, 192.168.100.0/24 (RFC 1918). MAC addresses come from the 00:00:5e:00:53:xx documentation block (RFC 7042).
The words control plane, forwarding (data) plane, northbound and southbound interface follow RFC 7426, the IETF’s SDN terminology.
Flow tables, the table-miss row (priority 0, matches anything), PACKET_IN, FLOW_MOD and PACKET_OUT are from the OpenFlow Switch Specification 1.5.1 (ONF). OpenFlow runs over TCP, optionally TLS, on IANA port 6653.
A table-miss row is just a normal row with priority 0. If a switch has none, OpenFlow drops packets that match nothing. How much of the packet goes up is set by the row’s output action (max_len), for example 128 bytes, or the whole packet.
SD-WAN is described by MEF 70. Products differ: most use their own control protocols between the controller and the site routers, not OpenFlow.

Quiz Unlocks after the last step.