Two planes
A switch or router does two jobs. The control plane decides where traffic should go. The data plane moves each packet out of the right port, very fast. Normally every box does both jobs, on its own.
Software-defined networking (SDN) takes the control plane out of the switches and puts it in one program: the controller. It runs on an ordinary server. The switches keep only the fast forwarding job.
Flow tables
Each switch now holds a flow table. Every row has match fields, such as a destination address, and actions, such as send out port 2 or drop. The switch uses the matching row with the highest priority.
Host A sends its first packet to host B. Switch 1 has no row for B yet. Only the table-miss row matches: priority 0, it matches anything, and its action is send it to the controller.
Switch 1 holds the packet and sends the controller a copy of its first bytes in a PACKET_IN message, over the control channel (TCP port 6653). Only this first packet has to wait for the answer.
The controller sees the whole network, so it works out the path: switch 1, 2, then 3. It sends each switch one new row, in a FLOW_MOD message: if the destination is 192.168.1.20, send it out this port.
The held packet goes on, and every next packet to B matches the new rows. Each switch forwards it at full speed, with no question to the controller. The controller decides once; the switches repeat it.
Apps and policy
Programs drive the controller through its northbound API, often a web (REST) API. A firewall app asks: block telnet (TCP port 23) to host B. It says what it wants, not how each switch should do it.
The controller turns the request into one row on switch 1: telnet to B, priority 200, no action, which means drop. It beats the forwarding row, so telnet stops at switch 1 while web traffic still flows.
Trade-offs
Gains: one view of the whole network, rules changed in one place, and programs instead of typing. Costs: the controller is a single point of failure, so real ones run as a cluster, and a first packet waits.
SD-WAN uses the same idea between offices. A central controller tells every site router which link to use for each app, such as fibre for video calls and 4G as a backup, and changes it from one screen.
The tables and the messages
;; step 1/11 · two-jobs · local ;; at s1 + s2 + s3 inside a classic switch or router: control plane decides: learns the map, builds the tables data plane forwards: looks up each packet, sends it out a port 3 switches = 3 separate brains, each with its own view changing a rule means logging in to every box
Flow tables, the table-miss row (priority 0, matches anything), PACKET_IN, FLOW_MOD and PACKET_OUT are from the OpenFlow Switch Specification 1.5.1 (ONF). OpenFlow runs over TCP, optionally TLS, on IANA port 6653. A table-miss row is just a normal row with priority 0. If a switch has none, OpenFlow drops packets that match nothing. How much of the packet goes up is set by the row’s output action (max_len), for example 128 bytes, or the whole packet. SD-WAN is described by MEF 70. Products differ: most use their own control protocols between the controller and the site routers, not OpenFlow.