SDN programming: Three Steps
- read/monitor network state as well as respond to events such as failures, topology changes, and security events
- compute the policy based on the state that the controller sees from the network
- write policy back to the switches by installing flow table state into the switches
Problems with consistency when reading network state
- Predicates
- Unfolding
- Suppression
Network Virtualization
abstracting the logical networks away from the physical equipment (network) - analogy VM and physical computer
Motivation for NV
Facilitate research/evolution by allowing coexistence;
Adjust resources devoted to any service at ant given time;
Benefits of NV
Rapid Innovation (at the rate of software evolves)
Allow new forms of network control
Simplify programming
NV vs SDN
- NV is one of the applications for SDN and SDN can be seen as a tool for implementing NV (NV can be accomplished without SDN such as Mininet in Project1)
- SDN does not necessarily imply Network Virtualization is employed. But NV allows SDN to be tested in a virtual environment to emulate physical network devices
SDN programming difficulty (openflow)
- low level of abstraction in the form of match-action rules
- controller only see events that switch don’t know how to handle
- race conditions if switch-level rules are not installed properly
Southbound API
the communication interface between the controller and the forwarding devices (such as openflow)
Northbound API
a higher-level programming interface between apps and controller so that an application is expressing what it wants to happen in terms of higher-level semantics such as policy APIs, billing APIs, and security APIs
Pyretic
SDN language (express high-level policies) and runtime (automatically compile these policies to low-level OpenFlow rules and install on hardware devices)
Pyretic features
- implement network policy as a function that map packet (input) to other packets (output: 0, 1 or other modified packets)
- Express boolean (and, or, not)
- Provide virtual packet header fields
- Provide composition operators (parallel and sequential )
Pyretic function examples
- identity: return original packet
- drop: return an empty set
- match(f=v): return the identity if the field f matches the value v, otherwise drop the packet
- mod(f=v): return the same packet with the field f set to v
- flood(): return one packet for each port on the network spanning tree
- fwd(a): forward packet to output port a
