SlideShare a Scribd company logo
1 of 46
Download to read offline
Introduction to
OpenFlow

.

Raj Jain
Washington University in Saint Louis
Saint Louis, MO 63130
Jain@cse.wustl.edu
These slides and audio/video recordings of this class lecture are at:
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-1

©2013 Raj Jain
Overview
Planes of Networking
2. OpenFlow
3. OpenFlow Operation
4. OpenFlow Switches including Open vSwitch
5. OpenFlow Evolution
6. Current Limitations and Issues
Note: SDN and NFV are discussed in later modules of this course.
1.

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-2

©2013 Raj Jain
Planes of Networking




Data Plane: All activities involving as well as
resulting from data packets sent by the end user, e.g.,
 Forwarding
 Fragmentation and reassembly
 Replication for multicasting
Control Plane: All activities that are necessary to perform data
plane activities but do not involve end-user data packets
 Making routing tables
 Setting packet handling policies (e.g., security)
 Base station beacons announcing availability of services

Ref: Open Data Center Alliance Usage Model: Software Defined Networking Rev 1.0,”
http://www.opendatacenteralliance.org/docs/Software_Defined_Networking_Master_Usage_Model_Rev1.0.pdf
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-3

©2013 Raj Jain
Planes of Networking (Cont)




Management Plane: All activities related to
provisioning and monitoring of the networks
 Fault, Configuration, Accounting, Performance and Security
(FCAPS).
 Instantiate new devices and protocols (Turn devices on/off)
 Optional  May be handled manually for small networks.
Services Plane: Middlebox services to improve performance or
security, e.g.,
 Load Balancers, Proxy Service, Intrusion Detection,
Firewalls, SSL Off-loaders
 Optional  Not required for small networks

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-4

©2013 Raj Jain
Data vs. Control Logic






Data plane runs at line rate,
e.g., 100 Gbps for 100 Gbps Ethernet  Fast Path
 Typically implemented using special hardware,
e.g., Ternary Content Addressable Memories (TCAMs)
Some exceptional data plane activities are handled by the CPU
in the switch  Slow path
e.g., Broadcast, Unknown, and Multicast (BUM) traffic
All control activities are generally handled by CPU
Control Logic
Data Logic

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-5

©2013 Raj Jain
OpenFlow: Key Ideas
1.
2.
3.

Separation of control and data planes
Centralization of control
Flow based control

Ref: N. McKeown, et al., ``OpenFlow: Enabling Innovation in Campus Networks," ACM SIGCOMM CCR,
Vol. 38, No. 2, April 2008, pp. 69-74.
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-6

©2013 Raj Jain
History of OpenFlow











2006: Martin Casado, a PhD student at Stanford and team
propose a clean-slate security architecture (SANE) which defines a
centralized control of security (in stead of at the edge as normally done).
Ethane generalizes it to all access policies.
April 2008: OpenFlow paper in ACM SIGCOMM CCR
2009: Stanford publishes OpenFlow V1.0.0 specs
June 2009: Martin Casado co-founds Nicira
March 2010: Guido Appenzeller, head of clean slate lab at Stanford, cofounds Big Switch Networks
March 2011: Open Networking Foundation is formed
Oct 2011: First Open Networking Summit.
Juniper, Cisco announce plans to incorporate.
July 2012: VMware buys Nicira for $1.26B
Nov 6, 2013: Cisco buys Insieme for $838M

Ref: ONF, “The OpenFlow Timeline,” http://openflownetworks.com/of_timeline.php
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-7

©2013 Raj Jain
Separation of Control and Data Plane
Control

Controller

Switch
Data

Forwarding
Element

Forwarding
Element

OpenFlow
Protocol

OpenFlow
Forwarding
Element

Forwarding
Element

Secure
Channel
Flow Table






Control logic is moved to a controller
Switches only have forwarding elements
One expensive controller with a lot of cheap switches
OpenFlow is the protocol to send/receive forwarding rules
from controller to switches

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-8

©2013 Raj Jain
OpenFlow V1.0


On packet arrival, match the header fields with flow entries in a
table, if any entry matches, update the counters indicated in that
entry and perform indicated actions
Flow Table: Header Fields Counters Actions
Header Fields Counters Actions
…
…
…
Header Fields Counters Actions

Ingress Ether Ether VLAN VLAN IP IP IP
IP Src L4 Dst L4
Port
Source Dest ID
Priority Src Dst Proto ToS Port
Port

Ref: http://archive.openflow.org/documents/openflow-spec-v1.0.0.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-9

©2013 Raj Jain
Flow Table Example
Dst L4 Port
ICMP Code
Src L4 Port
ICMP Type

Ref: S. Azodolmolky, "Software Defined Networking with OpenFlow," Packt Publishing, October 2013, 152 pp.,
ISBN:978-1-84969-872-6 (Safari Book)
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-10

Counter

Action

IP ToS



Src IP
EtherType

Idle timeout: Remove entry if no packets received for this time
Hard timeout: Remove entry after this time
If both are set, the entry is removed if either one expires.

Priority




IP Proto

Dst IP

VLAN ID

Src MAC

* 0A:C8:* * * * *
*
*
* * * Port 1
*
*
* * * * 192.168.*.*
*
* * * Port 2
*
*
* * * *
*
*
* 21 21 Drop
*
*
* * * *
*
0x806 * * * Local
*
*
* * * *
*
0x1* * * * Controller

Dst MAC

Port
*
*
*
*
*

102
202
420
444
1

©2013 Raj Jain
Set Input Port
Ether Src
Ether Dst
Ether Type
Set all others to zero
EtherType
=0x8100?
N
EtherType
=0x0806?
N
EtherType
=0x0800?

Matching

Set VLAN ID
Y Set VLAN Priority
Use EtherType in VLAN tag
for next EtherType Check
Y

Set IP Src, IP Dst
IP Proto, IP ToS
from within ARP

Y Set IP Src, IP Dst
IP Proto, IP ToS

N

Match
Table 0?
N
Match
Table n?
N

Not IP Y IP Proto
Fragment?
=6 or 7
N

Y

Apply
Actions

Y

Send to Controller
Y

Set Src Port,
Dst Port for
L4 fields

N

Use ICMP Type
IP Proto Y
and code for
=1?
L4 Fields
Packet lookup
N
using assigned
header fields
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-11

©2013 Raj Jain
Counters
Per Table
Active Entries
Packet Lookups
Packet Matches

Per Flow
Received Packets
Received Bytes
Duration (Secs)

Per Port
Received Packets
Transmitted Packets
Received Bytes

Per Queue
Transmit Packets
Transmit Bytes
Transmit overrun
errors

Duration (nanosecs) Transmitted Bytes
Receive Drops
Transmit Drops
Receive Errors
Transmit Errors
Receive Frame
Alignment Errors
Receive Overrun
erorrs
Receive CRC
Errors
Collisions
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-12

©2013 Raj Jain
Actions






Forward to Physical Port i or to Virtual Port:
 All: to all interfaces except incoming interface
 Controller: encapsulate and send to controller
 Local: send to its local networking stack
 Table: Perform actions in the flow table
 In_port: Send back to input port
 Normal: Forward using traditional Ethernet
 Flood: Send along minimum spanning tree except the
incoming interface
Enqueue: To a particular queue in the port  QoS
Drop
Modify Field: E.g., add/remove VLAN tags, ToS bits, Change
TTL

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-13

©2013 Raj Jain
Actions (Cont)









Masking allows matching only selected fields,
e.g., Dest. IP, Dest. MAC, etc.
If header matches an entry, corresponding actions are performed
and counters are updated
If no header match, the packet is queued and
the header is sent to the controller, which sends a new rule.
Subsequent packets of the flow are handled by this rule.
Secure Channel: Between controller and the switch using TLS
Modern switches already implement flow tables, typically using
Ternary Content Addressable Memories (TCAMs)
Controller can change the forwarding rules if a client moves
 Packets for mobile clients are forwarded correctly
Controller can send flow table entries beforehand (Proactive) or
Send on demand (Reactive). OpenFlow allows both models.

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-14

©2013 Raj Jain
Hardware OpenFlow Switches













Arista 7050
Brocade MLXe, Brocade CER, Brocade CES
Extreme Summit x440, x460, x670
Huawei openflow-capable router platforms
HP 3500, 3500yl, 5400zl, 6200yl, 6600, and 8200zl (the oldstyle L3 hardware match platform)
HP V2 line cards in the 5400zl and 8200zl (the newer L2
hardware match platform)
IBM 8264
Juniper (MX, EX)
NEC IP8800, NEC PF5240, NEC PF5820
NetGear 7328SO, NetGear 7352SO
Pronto (3290, 3295, 3780) - runs the shipping pica8 software
Switch Light platform

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-15

©2013 Raj Jain
Software OpenFlow Switches









Indigo: Open source implementation that runs on
physical switches and uses features of the ASICs to run OpenFlow
LINC: Open source implementation that runs on Linux, Solaris,
Windows, MacOS, and FreeBSD
Pantou: Turns a commercial wireless router/access point to an
OpenFlow enabled switch. OpenFlow runs on OpenWRT. Supports
generic Broadcom and some models of LinkSys and TP-Link access
points with Broadcom and Atheros chipsets.
Of13softswitch: User-space software switch based on Ericsson
TrafficLab 1.1 softswitch
XORPlus: Open source switching software to drive high-performance
ASICs. Supports STP/RSTP/MSTP, LCAP, QoS, VLAN, LLDP, ACL,
OSPF/ECMP, RIP, IGMP, IPv6, PIM-SM
Open vSwitch

Ref: http://www.openvswitch.org/, http://www.projectfloodlight.org/indigo/, http://flowforwarding.github.io/LINC-Switch/,
http://github.com/CPqD/openflow-openwrt, http://cpqd.github.io/ofsoftswitch13/, http://sourceforge.net/projects/xorplus
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis
©2013 Raj Jain

14-16
Open vSwitch







Open Source Virtual Switch
Nicira Concept
Can Run as a stand alone hypervisor switch or as a distributed
switch across multiple physical servers
Default switch in XenServer 6.0, Xen Cloud Platform and
supports Proxmox VE, VirtualBox, Xen KVM
Integrated into many cloud management systems including
OpenStack, openQRM, OpenNebula, and oVirt
Distributed with Ubuntu, Debian, Fedora Linux. Also FreeBSD

Ref: http://openvswitch.org/
Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-17

©2013 Raj Jain
Open vSwitch Features


Inter-VM communication monitoring via:
 NetFlow: Cisco protocol for sampling and collecting traffic
statistics (RFC 3954)
 sFlow: Similar to NetFlow by sflow.org (RFC 3176)
 Jflow: Juniper’s version of NetFlow
 NetStream: Huawei’s version of NetFlow
 IPFIX: IP Flow Information Export Protocol (RFC 7011) IETF standard for NetFlow
 SPAN, RSPAN: Remote Switch Port Analyzer – port
mirroring by sending a copy of all packets to a monitor port
 GRE-tunneled mirrors: Monitoring device is remotely
connected to the switch via a GRE tunnel

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-18

©2013 Raj Jain
Open vSwitch Features (Cont)












Link Aggregation Control Protocol (LACP)
IEEE 802.1Q VLAN
IEEE 802.1ag Connectivity Fault Management (CFM)
Bidirectional Forwarding Detection (BFD) to detect link faults
(RFC 5880)
IEEE 802.1D-1998 Spanning Tree Protocol (STP)
Per-VM traffic policing
OpenFlow
Multi-table forwarding pipeline
IPv6
GRE, VXLAN, IPSec tunneling
Kernel and user-space forwarding engine options

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-19

©2013 Raj Jain
OVSDB








Open vSwitch Database Management Protocol (OVSDB)
Monitoring capability using publish-subscribe mechanisms
Stores both provisioning and operational state
Java Script Object Notation (JSON) used for schema format
and for JSON-RPC over TCP for wire protocol (RFC 4627)
Control and Mgmt Cluster
<database-schema>
OVSDB
OpenFlow
“name”: <id>
OVSDB Server ovs-vswitchd
“version”: <version>
Forwarding Path
“tables”: {<id>: <table-schema>,…}
RPC Methods: List databases, Get Schema, Update, Lock, …
Open vSwitch project includes open source OVSDB client and
server implementations

Ref: B. Pfaff and B. Davie, “The Open vSwitch Database Management Protocol,” IETF draft, Oct 2013,
http://tools.ietf.org/html/draft-pfaff-ovsdb-proto-04
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-20

©2013 Raj Jain
OpenFlow V1.1




V1: Perform action on a match. Ethernet/IP only. Single Path
Did not cover MPLS, Q-in-Q, ECMP, and efficient Multicast
V1.1 Introduced Table chaining, Group Tables, and added
MPLS Label and MPLS traffic class to match fields.
Table Chaining: On a match, instruction may be Controller
OpenFlow
 Immediate actions: modify packet,
update match fields and/or
Secure
Group
Channel
Table
 Update action set, and/or
Flow
Flow
 Send match data and action set to Table n,
Table
Table
 Go to Group Table entry n
Table 1

Action Set = {}
Washington University in St. Louis

Table 2

Table 3

Table n

Action Set = {1}
http://www.cse.wustl.edu/~jain/cse570-13/

14-21

Group Table
Action Set = {1,3,6,…}
©2013 Raj Jain
OpenFlow V1.1 (Cont)





On a miss, the instruction may be to send packet to controller
or continue processing with the sequentially next table
Group Tables: each entry has a variable number of buckets
 All: Execute each bucket. Used for Broadcast, Multicast.
 Select: Execute one switch selected bucket. Used for port
mirroring. Selection may be done by hashing some fields.
 Indirect: Execute one predefined bucket.
 Fast Failover: Execute the first live bucket  Live port
New Features supported:
 Multipath: A flow can be sent over one of several paths
 MPLS: multiple labels, traffic class, TTL, push/pop labels
 Q-in-Q: Multiple VLAN tags, push/pop VLAN headers
 Tunnels: via virtual ports

Ref: http://archive.openflow.org/documents/openflow-spec-v1.1.0.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-22

©2013 Raj Jain
OpenFlow V1.2
1.

2.
3.

IPv6 Support: Matching fields include IPv6 source address,
destination address, protocol number, traffic class. ICMPv6
type, ICMPv6 code, IPv6 neighbor discovery header fields,
and IPv6 flow labels.
Extensible Matches: Type-Length-Value (TLV) structure.
Previously the order and length of match fields was fixed.
Experimenter extensions through dedicated fields and code
points assigned by ONF

Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.2.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis
©2013 Raj Jain

14-23
OpenFlow 1.3











IPv6 extension headers: Can check if Hop-by-hop, Router,
Fragmentation, Destination options, Authentication, Encrypted
Security Payload (ESP), unknown extension headers are
present
MPLS Bottom-of-Stack bit matching
MAC-in-MAC encapsulation
Tunnel ID meta data: Support for tunnels (VxLAN, …)
Per-Connection Event Filtering: Better filtering of
connections to multiple controllers
Many auxiliary connections to the controller allow to exploit
parallelism
Better capability negotiation: Requests can span multiple
messages
More general experimenter capabilities allowed
A separate flow entry for table miss actions

Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.3.0.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis
©2013 Raj Jain

14-24
OpenFlow V1.3 (Cont)







Cookies: A cookie field is added to messages containing new
packets sent to the controller. This helps controller process the
messages faster than if it had to search its entire database.
Duration: Duration field has been added to most stats. Helps
compute rates.
Per-flow counters can be disabled to improve performance
Per Flow Meters and meter bands
Meter: Switch element that can measure and control the rate of
packets/bytes.
 Meter Band: If the packet/byte rate exceeds a pre-defined
Band 2
threshold  the meter has triggered the band
Band 1
 A meter may have multiple bands
Time

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-25

©2013 Raj Jain
OpenFlow V1.3 (Cont)







If on triggering a band the meter drops the packet, it is
called rate limiter.
Other QoS and policing mechanisms can be designed using
these meters
Meters are attached to a flow entry not to a queue or a port.
Multiple flow entries can all point to the same meter.

Match Fields Priority Counters Instructions Timeouts Timeouts Cookie
New Instruction: Meter Meter_ID
Meter ID Meter Bands Counters
Band Type Rate Counters Type Specific Arguments
1. Drop
2. Remark DSCP
Washington University in St. Louis

kb/s
Burst
http://www.cse.wustl.edu/~jain/cse570-13/

14-26

©2013 Raj Jain
OpenFlow V1.4









Optical ports: Configure and monitor transmit and receive
frequencies of lasers and their power
Improved Extensibility: Type-Length-Value (TLV) encodings
at most places  Easy to add new features in future
Extended Experimenter Extension API: Can easily add
ports, tables, queues, instructions, actions, etc.
More information when a packet is sent to controller, e.g., no
match, invalid TTL, matching group bucket, matching action, ..
Controllers can select a subset of flow tables for monitoring
Switches can evict entries of lower importance if table full
Switches can notify controller if table is getting full
Atomic execution of a bundle of instructions

Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.4.0.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis
©2013 Raj Jain

14-27
OpenFlow Evolution Summary
MPLS, Q-in-Q
Efficient multicast
ECMP
 Multiple Tables

MAC-in-MAC
Multiple channels
between switch
and controller

Bug Fix

Dec 2009 Feb 2011 Dec 2011 Apr 2012 Jun 2012 Sep 2012 Oct 2013
V1.0
V1.1
V1.2
V1.3
V1.3.1
V1.3.2
V1.4

Single Flow Table
Ethernet/IPv4
Washington University in St. Louis

IPv6
TLV matching
Multiple controllers

Bug Fix

http://www.cse.wustl.edu/~jain/cse570-13/

14-28

OTN
Experimenters
Bundles
Table full
©2013 Raj Jain
Bootstrapping







Switches require initial configuration: Switch IP address,
Controller IP address, Default gateway
Switches connect to the controller
Switch provides configuration information about ports
Controller installs a rule to forward LLDP responses to
controller and then sends a LLDP request which is forwarded
to all neighbors.
Controller determines the topology from LLDP responses

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-29

©2013 Raj Jain
OpenFlow Configuration Protocol
(OF-Config)



OpenFlow Control Point: Entity that configures OpenFlow
switches
OF-Config: Protocol used for configuration and management
of OpenFlow Switches.
Assignment of OF controllers so that switches can initiate
connections to them:
 IP address of controller
OpenFlow
OpenFlow
 Port number at the controller
Configuration
Controller
 Transport protocol:
Point
OpenFlow
TLS or TCP
OF-Config
Protocol
 Configuration of queues
(min/max rates) and ports
OpenFlow
 Enable/disable receive/forward
Switch
Operational Context
speed, media on ports

Ref: Cisco, “An Introduction to OpenFlow,” Feb 2013,
http://www.cisco.com/web/solutions/trends/open_network_environment/docs/cisco_one_webcastan_introduction_to_openflowfebruary142013.pdf

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-30

©2013 Raj Jain
OF-Config (Cont)



A physical switch = one or more logical switches
each controlled by an OF Controller
OF-Config allows configuration of logical switches.
OpenFlow
Configuration
Point

OpenFlow
Controller
OpenFlow
Protocol

OF-Config
OF Capable Switch

OF Logical
Switch

…

OF Logical
Switch

Ref: ONF, “OpenFlow Management and Configuration Protocol (OF-Config 1.1.1),” March 23, 2013,
https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1-1-1.pdf
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis
©2013 Raj Jain

14-31
OF-Config Concepts









OF Capable Switch: Physical OF switch.
Can contain one or more OF logical switches.
OpenFlow Configuration Point: configuration service
OF Controller: Controls logical switch via OF protocol
Operational Context: OF logical switch
OF Queue: Queues of packets waiting for forwarding
OF Port: forwarding interface. May be physical or logical.
OF Resource: ports, queues, certificates, flow tables and other
resources of OF capable switches assigned to a logical switch
Datapath ID: 64-ID of the switch. Lower 48-bit = Switch
MAC address, Upper 16-bit assigned by the operator

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-32

©2013 Raj Jain
OF-Config Evolution







V1.0 (Jan 2012): Based on OpenFlow V1.2
 Assign controllers to logical switches
 Retrieve logical switch configurations
 Configure ports and queues
V1.1 (May 2012): Based on OpenFlow V1.3
 Configuration of certificates
 Capability Discovery: Retrieve logical switch capabilities
 Configure logical tunnels (VXLAN, NVGRE, …)
V1.1.1 (Jan 2013): Bug Fix. Versioning support
V1.2 (Not published yet): Based on OpenFlow V1.4
 Simple topology Detection
 Assigning resources to logical switches

Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config1dot0-final.pdf
https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1.1.pdf
https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1-1-1.pdf

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-33

©2013 Raj Jain
OpenFlow Notification Framework
Notification: Event triggered messages, e.g., link down
 Publish/subscribe model: Switch = publisher. OpenFlow
controller or OpenFlow config points, and others can subscribe.
They will be notified about the events they subscribe.
 Use ITU-T M.3702 Notifications: Attribute value change,
Communication alarm, Environmental alarm, Equipment
alarm, QoS alarm, Processing error alarm, Security alarm, State
change, Object creation and deletion
 Pre-existing Notifications: Do not fit in the framework but
will be recognized.
 OpenFlow: Packet-in, Flow removed, Port Status, Error,
Hello, Echo request, Echo reply, Experimenter
 OpenFlow Config: OpenFlow logical switch instantiation,
OpenFlow capability switch capability change, Successful
OpenFLow session establishment, Failed OpenFlow session
establishment, Port failure or recovery
Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-notifications-framework-1.0.pdf


Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-34

©2013 Raj Jain
Implementation Issues






40+ matching fields in a flow
Multiple tables, each with a large number of flow entries
Instructions and actions for each table
Need VXLAN, NVGRE, etc. support
For a large network, flow level programming can take a long
time
Table 0

Table 1

… Table n

Group Table

Logical Ports
Port Management

VxLAN

NVGRE

Physical Ports
Ref: R. Oshana and S. Addepalli, “Networking Trends- Software Defined Networking, Network Virtualization and Cloud Orchestration,” Asia Power Arch. Conf,
Oct 2012, https://www.power.org/wp-content/uploads/2012/10/13.-FSL-SDN-Openflow-and-Cloud-computing-UPD_Rob-Oshana.pdf

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-35

©2013 Raj Jain
OpenFlow: Future Work Items









Each controller has its own way to program.
Need a common standard “Northbound API”
No standard API for communication between controllers of
overlapping domain  Need an East-West API
Ability to continue operation when the controller is down
Many other packet formats (non-IP, non-Ethernet, …)
Flow  Decide once, use many times  Performance
 But does not help non-flow based request/response apps
Need API to encrypt data plane packets
Need API to inject packets
Need API to instantiate a service, such as a firewall, IDS, on
the switch

Ref: T. Nadeau and K. Gray, “SDN,” O’Reilly, 2013, 384 pp, ISBN:978-1-449-34230-2
http://www.cse.wustl.edu/~jain/cse570-13/
Washington University in St. Louis

14-36

©2013 Raj Jain
Summary
1.
2.
3.

4.
5.

Four planes of Networking: Data, Control, Management,
Service
OpenFlow separates control plane and moves it to a central
controller  Simplifies the forwarding element
Switches match incoming packets with flow entries in a table
and handle it as instructed. The controller supplies the flow
tables and other instructions.
Many hardware and software based switches including Open
vSwitch
OpenFlow has been extended to IPv4, MPLS, IPv6, and
Optical Network. But more work ahead.

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-37

©2013 Raj Jain
Reading List





S. Azodolmolky, "Software Defined Networking with
OpenFlow," Packt Publishing, October 2013, 152 pp.,
ISBN:978-1-84969-872-6 (Safari Book)
T. Nadeau and K. Gray, “SDN,” O’Reilly, 2013, 384 pp,
ISBN:978-1-449-34230-2B (Safari Book)
Pfaff and B. Davie, “The Open vSwitch Database Management
Protocol,” IETF draft, Oct 2013, http://tools.ietf.org/html/draftpfaff-ovsdb-proto-04

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-38

©2013 Raj Jain
References









N. McKeown, et al., ``OpenFlow: Enabling Innovation in Campus
Networks," ACM SIGCOMM CCR, Vol. 38, No. 2, April 2008, pp. 69-74.
ONF, “The OpenFlow Timeline,”
http://openflownetworks.com/of_timeline.php
Open Data Center Alliance Usage Model: Software Defined Networking
Rev 1.0,”
http://www.opendatacenteralliance.org/docs/Software_Defined_Networking
_Master_Usage_Model_Rev1.0.pdf
R. Oshana and S. Addepalli, “Networking Trends- Software Defined
Networking, Network Virtualization and Cloud Orchestration,” Asia Power
Arch. Conf, Oct 2012, https://www.power.org/wpcontent/uploads/2012/10/13.-FSL-SDN-Openflow-and-Cloud-computingUPD_Rob-Oshana.pdf
ONF, "OpenFlow Specifications V1.0.0,"
http://archive.openflow.org/documents/openflow-spec-v1.0.0.pdf
ONF, "OpenFlow Specifications V1.1.0,"
http://archive.openflow.org/documents/openflow-spec-v1.1.0.pdf

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-39

©2013 Raj Jain
References (Cont)













ONF, "OpenFlow Specifications V1.2.0,"
https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-spec-v1.2.pdf
ONF, "OpenFlow Specifications V1.3.0,"
https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-spec-v1.3.0.pdf
ONF, "OpenFlow Specifications V1.4.0,"
https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-specv1.4.0.pdfhttp://openvswitch.org/
http://www.openvswitch.org/
http://www.projectfloodlight.org/indigo/
http://flowforwarding.github.io/LINC-Switch/
http://github.com/CPqD/openflow-openwrt
http://cpqd.github.io/ofsoftswitch13/
http://sourceforge.net/projects/xorplus

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-40

©2013 Raj Jain
Wikipedia Links










http://en.wikipedia.org/wiki/OpenFlow
http://en.wikipedia.org/wiki/Software-defined_networking
http://en.wikipedia.org/wiki/Network_Functions_Virtualization
http://en.wikipedia.org/wiki/Forwarding_plane
http://en.wikipedia.org/wiki/NetFlow
http://en.wikipedia.org/wiki/IP_Flow_Information_Export
http://en.wikipedia.org/wiki/SFlow
http://en.wikipedia.org/wiki/Northbound_interface
http://en.wikipedia.org/wiki/Big_Switch_Networks

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-41

©2013 Raj Jain
Wikipedia Links (Optional)












http://en.wikipedia.org/wiki/Open_Data_Center_Alliance
http://en.wikipedia.org/wiki/Virtual_Extensible_LAN
http://en.wikipedia.org/wiki/Optical_Transport_Network
http://en.wikipedia.org/wiki/Automatically_switched_optical_n
etwork
http://en.wikipedia.org/wiki/Wavelength-division_multiplexing
http://en.wikipedia.org/wiki/IEEE_802.1ad
http://en.wikipedia.org/wiki/Transport_Layer_Security
http://en.wikipedia.org/wiki/OpenStack
http://en.wikipedia.org/wiki/IPv6_packet
http://en.wikipedia.org/wiki/ICMPv6
http://en.wikipedia.org/wiki/Multiprotocol_Label_Switching

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-42

©2013 Raj Jain
Acronyms

















ACL
API
ARP
ASICs
BFD
BUM
CFM
CPU
DFCA
DSCP
ECMP
ESP
FCAPS
GRE
ICMP
ID

Access Control List
Application Programming Interface
Address Resolution Protocol
Application Specific Integrated Circuit
Bidirectional Forwarding Detection
Broadcast, Unknown, and Multicast
Connectivity Fault Management
Central Processing Unit
Dynamic Frequency Channel Allocation
Differentiated Service Control Point
Equal Cost Multipath
Encrytec Security Payload
Fault, Configuration, Accounting, Performance and Security
Generic Routing Encapsulation
Internet Control Message Protocol
Identifier

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-43

©2013 Raj Jain
Acronyms (Cont)

















IDS
IEEE
IETF
IGMP
IP
IPFIX
IPSec
IPv4
IPv6
JSON
KVM
LACP
LLDP
MAC
MAN
MPLS

Intrusion Detection System
Institution of Electrical and Electronic Engineers
Internet Engineering Task Force
Internet Group Multicast Protocol
Internet Protocol
IP Flow Information Export Protocol
IP Security
Internet Protocol version 4
Internet Protocol version 6
Java Script Object Notation
Kernel-based Virtual Machine
Link Aggregation Control Protocol
Link Layer Discovery Protocol
Media Access Control
Metropolitan Area Network
Multiprotocol Label Switching

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-44

©2013 Raj Jain
Acronyms (Cont)

















NFV
NVGRE
OF
ONF
openQRM
OpenWRT
OSPF
OTN
OVSDB
PIM-SM
PIM
QoS
RAN
RFC
RIP
RIP

Network Function Virtualization
Network Virtualization using Generic Routing Encapsulation
OpenFlow
Open Networking Foundation
Open Qlusters Resource Manager
Open WRT54G (Linksys product name) software
Open Shortest Path First
Optical Transport Network
Open vSwitch Database
Protocol Independent Multicast - Sparse Mode
Protocol Independent Multicast
Quality of Service
Radio area networks
Request for Comments
IGMP, IPv6, PIM-SM
Routing Information Protocol

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-45

©2013 Raj Jain
Acronyms (Cont)



















RPC
RSPAN
SDN
SPAN
SSL
STP
TCAM
TCP
TLS
TLV
ToS
TTL
TTP
UDP
VLAN
VM
VxLAN
WG

Remote Procedure Call
Remote Switch Port Analyzer
Software Defined Network
Switch Port Analyzer
Secure Socket Layer
Spanning Tree Protocol
Ternary Content Addressable Memory
Transmission Control Protocol
Transport Level Security
Type-Length-Value
Type of Service
Time to Live
Table Typing Patterns
User Datagram Protocol
Virtual Local Area Network
Virtual Machine
Virtual Extensible Local Area Network
Working Group

Washington University in St. Louis

http://www.cse.wustl.edu/~jain/cse570-13/

14-46

©2013 Raj Jain

More Related Content

What's hot

What's hot (20)

Software Defined Network (SDN)
Software Defined Network (SDN)Software Defined Network (SDN)
Software Defined Network (SDN)
 
SDN Fundamentals - short presentation
SDN Fundamentals -  short presentationSDN Fundamentals -  short presentation
SDN Fundamentals - short presentation
 
Wireshark
WiresharkWireshark
Wireshark
 
Network Packet Analysis with Wireshark
Network Packet Analysis with WiresharkNetwork Packet Analysis with Wireshark
Network Packet Analysis with Wireshark
 
Software Defined Networking (SDN) Technology Brief
Software Defined Networking (SDN) Technology BriefSoftware Defined Networking (SDN) Technology Brief
Software Defined Networking (SDN) Technology Brief
 
Network Virtualization
Network VirtualizationNetwork Virtualization
Network Virtualization
 
IPSec and VPN
IPSec and VPNIPSec and VPN
IPSec and VPN
 
TCP-IP Reference Model
TCP-IP Reference ModelTCP-IP Reference Model
TCP-IP Reference Model
 
SDN-ppt-new
SDN-ppt-newSDN-ppt-new
SDN-ppt-new
 
ASA Firewall Interview- Questions & Answers
ASA Firewall Interview- Questions & AnswersASA Firewall Interview- Questions & Answers
ASA Firewall Interview- Questions & Answers
 
Packet analysis using wireshark
Packet analysis using wiresharkPacket analysis using wireshark
Packet analysis using wireshark
 
Port forwarding
Port forwardingPort forwarding
Port forwarding
 
Introduction to OpenFlow, SDN and NFV
Introduction to OpenFlow, SDN and NFVIntroduction to OpenFlow, SDN and NFV
Introduction to OpenFlow, SDN and NFV
 
Chapter3
Chapter3Chapter3
Chapter3
 
SDN: an introduction
SDN: an introductionSDN: an introduction
SDN: an introduction
 
IGMP
IGMPIGMP
IGMP
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in Depth
 
Secure sd wan
Secure sd wanSecure sd wan
Secure sd wan
 
Software Defined networking (SDN)
Software Defined networking (SDN)Software Defined networking (SDN)
Software Defined networking (SDN)
 
Network analysis Using Wireshark Lesson 11: TCP and UDP Analysis
Network analysis Using Wireshark Lesson 11: TCP and UDP AnalysisNetwork analysis Using Wireshark Lesson 11: TCP and UDP Analysis
Network analysis Using Wireshark Lesson 11: TCP and UDP Analysis
 

Viewers also liked

Viewers also liked (7)

Openflow Protocol
Openflow ProtocolOpenflow Protocol
Openflow Protocol
 
Architecture of OpenFlow SDNs
Architecture of OpenFlow SDNsArchitecture of OpenFlow SDNs
Architecture of OpenFlow SDNs
 
OpenFlow tutorial
OpenFlow tutorialOpenFlow tutorial
OpenFlow tutorial
 
SDN - OpenFlow protocol
SDN - OpenFlow protocolSDN - OpenFlow protocol
SDN - OpenFlow protocol
 
OpenFlow Overview
OpenFlow OverviewOpenFlow Overview
OpenFlow Overview
 
OpenFlow 1.5.1
OpenFlow 1.5.1OpenFlow 1.5.1
OpenFlow 1.5.1
 
NFV for beginners
NFV for beginnersNFV for beginners
NFV for beginners
 

Similar to Introduction to OpenFlow

OpenFlow Controllers and Tools
OpenFlow Controllers and ToolsOpenFlow Controllers and Tools
OpenFlow Controllers and Toolsrjain51
 
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...rjain51
 
SDN and NFV: Facts, Extensions, and Carrier Opportunities
SDN and NFV: Facts, Extensions, and Carrier OpportunitiesSDN and NFV: Facts, Extensions, and Carrier Opportunities
SDN and NFV: Facts, Extensions, and Carrier Opportunitiesrjain51
 
Naveen nimmu sdn future of networking
Naveen nimmu sdn   future of networkingNaveen nimmu sdn   future of networking
Naveen nimmu sdn future of networkingOpenSourceIndia
 
Naveen nimmu sdn future of networking
Naveen nimmu sdn   future of networkingNaveen nimmu sdn   future of networking
Naveen nimmu sdn future of networkingsuniltomar04
 
Networking Issues For Big Data
Networking Issues For Big DataNetworking Issues For Big Data
Networking Issues For Big Datarjain51
 
Analytical Modeling of End-to-End Delay in OpenFlow Based Networks
Analytical Modeling of End-to-End Delay in OpenFlow Based NetworksAnalytical Modeling of End-to-End Delay in OpenFlow Based Networks
Analytical Modeling of End-to-End Delay in OpenFlow Based NetworksAzeem Iqbal
 
Network Virtualization in Cloud Data Centers
Network Virtualization in Cloud Data CentersNetwork Virtualization in Cloud Data Centers
Network Virtualization in Cloud Data Centersrjain51
 
Openlab.2014 02-13.major.vi sion
Openlab.2014 02-13.major.vi sionOpenlab.2014 02-13.major.vi sion
Openlab.2014 02-13.major.vi sionCcie Light
 
Service Function Chaining in Openstack Neutron
Service Function Chaining in Openstack NeutronService Function Chaining in Openstack Neutron
Service Function Chaining in Openstack NeutronMichelle Holley
 
Network programmability: an Overview
Network programmability: an Overview Network programmability: an Overview
Network programmability: an Overview Aymen AlAwadi
 
Socket Programming - nitish nagar
Socket Programming - nitish nagarSocket Programming - nitish nagar
Socket Programming - nitish nagarNitish Nagar
 
Carrier Ethernet
Carrier EthernetCarrier Ethernet
Carrier Ethernetrjain51
 
Mr201304 open flow_security_eng
Mr201304 open flow_security_engMr201304 open flow_security_eng
Mr201304 open flow_security_engFFRI, Inc.
 
Data Center Ethernet
Data Center EthernetData Center Ethernet
Data Center Ethernetrjain51
 
Network programming in Java
Network programming in JavaNetwork programming in Java
Network programming in JavaTushar B Kute
 

Similar to Introduction to OpenFlow (20)

M 14ofl
M 14oflM 14ofl
M 14ofl
 
OpenFlow Controllers and Tools
OpenFlow Controllers and ToolsOpenFlow Controllers and Tools
OpenFlow Controllers and Tools
 
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...
LAN Extension and Network Virtualization for Cloud Computing using Layer 3 Pr...
 
SDN and NFV: Facts, Extensions, and Carrier Opportunities
SDN and NFV: Facts, Extensions, and Carrier OpportunitiesSDN and NFV: Facts, Extensions, and Carrier Opportunities
SDN and NFV: Facts, Extensions, and Carrier Opportunities
 
Naveen nimmu sdn future of networking
Naveen nimmu sdn   future of networkingNaveen nimmu sdn   future of networking
Naveen nimmu sdn future of networking
 
Naveen nimmu sdn future of networking
Naveen nimmu sdn   future of networkingNaveen nimmu sdn   future of networking
Naveen nimmu sdn future of networking
 
Networking Issues For Big Data
Networking Issues For Big DataNetworking Issues For Big Data
Networking Issues For Big Data
 
Analytical Modeling of End-to-End Delay in OpenFlow Based Networks
Analytical Modeling of End-to-End Delay in OpenFlow Based NetworksAnalytical Modeling of End-to-End Delay in OpenFlow Based Networks
Analytical Modeling of End-to-End Delay in OpenFlow Based Networks
 
Network Virtualization in Cloud Data Centers
Network Virtualization in Cloud Data CentersNetwork Virtualization in Cloud Data Centers
Network Virtualization in Cloud Data Centers
 
Openflow
OpenflowOpenflow
Openflow
 
Openlab.2014 02-13.major.vi sion
Openlab.2014 02-13.major.vi sionOpenlab.2014 02-13.major.vi sion
Openlab.2014 02-13.major.vi sion
 
Service Function Chaining in Openstack Neutron
Service Function Chaining in Openstack NeutronService Function Chaining in Openstack Neutron
Service Function Chaining in Openstack Neutron
 
Network programmability: an Overview
Network programmability: an Overview Network programmability: an Overview
Network programmability: an Overview
 
Socket Programming - nitish nagar
Socket Programming - nitish nagarSocket Programming - nitish nagar
Socket Programming - nitish nagar
 
Sockets
SocketsSockets
Sockets
 
Carrier Ethernet
Carrier EthernetCarrier Ethernet
Carrier Ethernet
 
Mr201304 open flow_security_eng
Mr201304 open flow_security_engMr201304 open flow_security_eng
Mr201304 open flow_security_eng
 
BuildingSDNmanageableswitch.pdf
BuildingSDNmanageableswitch.pdfBuildingSDNmanageableswitch.pdf
BuildingSDNmanageableswitch.pdf
 
Data Center Ethernet
Data Center EthernetData Center Ethernet
Data Center Ethernet
 
Network programming in Java
Network programming in JavaNetwork programming in Java
Network programming in Java
 

More from rjain51

Internet of Things: Challenges and Issues
Internet of Things: Challenges and IssuesInternet of Things: Challenges and Issues
Internet of Things: Challenges and Issuesrjain51
 
Introduction to Internet of Things
Introduction to Internet of ThingsIntroduction to Internet of Things
Introduction to Internet of Thingsrjain51
 
Introduction to Network Function Virtualization (NFV)
Introduction to Network Function Virtualization (NFV)Introduction to Network Function Virtualization (NFV)
Introduction to Network Function Virtualization (NFV)rjain51
 
Big Data Fundamentals
Big Data FundamentalsBig Data Fundamentals
Big Data Fundamentalsrjain51
 
Data Center Networks:Virtual Bridging
Data Center Networks:Virtual BridgingData Center Networks:Virtual Bridging
Data Center Networks:Virtual Bridgingrjain51
 
Application Delivery Networking
Application Delivery NetworkingApplication Delivery Networking
Application Delivery Networkingrjain51
 
Storage Virtualization
Storage VirtualizationStorage Virtualization
Storage Virtualizationrjain51
 
Server Virtualization
Server VirtualizationServer Virtualization
Server Virtualizationrjain51
 
Data Center Network Topologies
Data Center Network TopologiesData Center Network Topologies
Data Center Network Topologiesrjain51
 
Networking Protocols for Internet of Things
Networking Protocols for Internet of ThingsNetworking Protocols for Internet of Things
Networking Protocols for Internet of Thingsrjain51
 

More from rjain51 (10)

Internet of Things: Challenges and Issues
Internet of Things: Challenges and IssuesInternet of Things: Challenges and Issues
Internet of Things: Challenges and Issues
 
Introduction to Internet of Things
Introduction to Internet of ThingsIntroduction to Internet of Things
Introduction to Internet of Things
 
Introduction to Network Function Virtualization (NFV)
Introduction to Network Function Virtualization (NFV)Introduction to Network Function Virtualization (NFV)
Introduction to Network Function Virtualization (NFV)
 
Big Data Fundamentals
Big Data FundamentalsBig Data Fundamentals
Big Data Fundamentals
 
Data Center Networks:Virtual Bridging
Data Center Networks:Virtual BridgingData Center Networks:Virtual Bridging
Data Center Networks:Virtual Bridging
 
Application Delivery Networking
Application Delivery NetworkingApplication Delivery Networking
Application Delivery Networking
 
Storage Virtualization
Storage VirtualizationStorage Virtualization
Storage Virtualization
 
Server Virtualization
Server VirtualizationServer Virtualization
Server Virtualization
 
Data Center Network Topologies
Data Center Network TopologiesData Center Network Topologies
Data Center Network Topologies
 
Networking Protocols for Internet of Things
Networking Protocols for Internet of ThingsNetworking Protocols for Internet of Things
Networking Protocols for Internet of Things
 

Recently uploaded

Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxBkGupta21
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 

Recently uploaded (20)

Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptx
 
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfHyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptx
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 

Introduction to OpenFlow

  • 1. Introduction to OpenFlow . Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu These slides and audio/video recordings of this class lecture are at: http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-1 ©2013 Raj Jain
  • 2. Overview Planes of Networking 2. OpenFlow 3. OpenFlow Operation 4. OpenFlow Switches including Open vSwitch 5. OpenFlow Evolution 6. Current Limitations and Issues Note: SDN and NFV are discussed in later modules of this course. 1. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-2 ©2013 Raj Jain
  • 3. Planes of Networking   Data Plane: All activities involving as well as resulting from data packets sent by the end user, e.g.,  Forwarding  Fragmentation and reassembly  Replication for multicasting Control Plane: All activities that are necessary to perform data plane activities but do not involve end-user data packets  Making routing tables  Setting packet handling policies (e.g., security)  Base station beacons announcing availability of services Ref: Open Data Center Alliance Usage Model: Software Defined Networking Rev 1.0,” http://www.opendatacenteralliance.org/docs/Software_Defined_Networking_Master_Usage_Model_Rev1.0.pdf Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-3 ©2013 Raj Jain
  • 4. Planes of Networking (Cont)   Management Plane: All activities related to provisioning and monitoring of the networks  Fault, Configuration, Accounting, Performance and Security (FCAPS).  Instantiate new devices and protocols (Turn devices on/off)  Optional  May be handled manually for small networks. Services Plane: Middlebox services to improve performance or security, e.g.,  Load Balancers, Proxy Service, Intrusion Detection, Firewalls, SSL Off-loaders  Optional  Not required for small networks Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-4 ©2013 Raj Jain
  • 5. Data vs. Control Logic    Data plane runs at line rate, e.g., 100 Gbps for 100 Gbps Ethernet  Fast Path  Typically implemented using special hardware, e.g., Ternary Content Addressable Memories (TCAMs) Some exceptional data plane activities are handled by the CPU in the switch  Slow path e.g., Broadcast, Unknown, and Multicast (BUM) traffic All control activities are generally handled by CPU Control Logic Data Logic Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-5 ©2013 Raj Jain
  • 6. OpenFlow: Key Ideas 1. 2. 3. Separation of control and data planes Centralization of control Flow based control Ref: N. McKeown, et al., ``OpenFlow: Enabling Innovation in Campus Networks," ACM SIGCOMM CCR, Vol. 38, No. 2, April 2008, pp. 69-74. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-6 ©2013 Raj Jain
  • 7. History of OpenFlow          2006: Martin Casado, a PhD student at Stanford and team propose a clean-slate security architecture (SANE) which defines a centralized control of security (in stead of at the edge as normally done). Ethane generalizes it to all access policies. April 2008: OpenFlow paper in ACM SIGCOMM CCR 2009: Stanford publishes OpenFlow V1.0.0 specs June 2009: Martin Casado co-founds Nicira March 2010: Guido Appenzeller, head of clean slate lab at Stanford, cofounds Big Switch Networks March 2011: Open Networking Foundation is formed Oct 2011: First Open Networking Summit. Juniper, Cisco announce plans to incorporate. July 2012: VMware buys Nicira for $1.26B Nov 6, 2013: Cisco buys Insieme for $838M Ref: ONF, “The OpenFlow Timeline,” http://openflownetworks.com/of_timeline.php http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-7 ©2013 Raj Jain
  • 8. Separation of Control and Data Plane Control Controller Switch Data Forwarding Element Forwarding Element OpenFlow Protocol OpenFlow Forwarding Element Forwarding Element Secure Channel Flow Table     Control logic is moved to a controller Switches only have forwarding elements One expensive controller with a lot of cheap switches OpenFlow is the protocol to send/receive forwarding rules from controller to switches Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-8 ©2013 Raj Jain
  • 9. OpenFlow V1.0  On packet arrival, match the header fields with flow entries in a table, if any entry matches, update the counters indicated in that entry and perform indicated actions Flow Table: Header Fields Counters Actions Header Fields Counters Actions … … … Header Fields Counters Actions Ingress Ether Ether VLAN VLAN IP IP IP IP Src L4 Dst L4 Port Source Dest ID Priority Src Dst Proto ToS Port Port Ref: http://archive.openflow.org/documents/openflow-spec-v1.0.0.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-9 ©2013 Raj Jain
  • 10. Flow Table Example Dst L4 Port ICMP Code Src L4 Port ICMP Type Ref: S. Azodolmolky, "Software Defined Networking with OpenFlow," Packt Publishing, October 2013, 152 pp., ISBN:978-1-84969-872-6 (Safari Book) http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-10 Counter Action IP ToS  Src IP EtherType Idle timeout: Remove entry if no packets received for this time Hard timeout: Remove entry after this time If both are set, the entry is removed if either one expires. Priority   IP Proto Dst IP VLAN ID Src MAC * 0A:C8:* * * * * * * * * * Port 1 * * * * * * 192.168.*.* * * * * Port 2 * * * * * * * * * 21 21 Drop * * * * * * * 0x806 * * * Local * * * * * * * 0x1* * * * Controller Dst MAC Port * * * * * 102 202 420 444 1 ©2013 Raj Jain
  • 11. Set Input Port Ether Src Ether Dst Ether Type Set all others to zero EtherType =0x8100? N EtherType =0x0806? N EtherType =0x0800? Matching Set VLAN ID Y Set VLAN Priority Use EtherType in VLAN tag for next EtherType Check Y Set IP Src, IP Dst IP Proto, IP ToS from within ARP Y Set IP Src, IP Dst IP Proto, IP ToS N Match Table 0? N Match Table n? N Not IP Y IP Proto Fragment? =6 or 7 N Y Apply Actions Y Send to Controller Y Set Src Port, Dst Port for L4 fields N Use ICMP Type IP Proto Y and code for =1? L4 Fields Packet lookup N using assigned header fields Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-11 ©2013 Raj Jain
  • 12. Counters Per Table Active Entries Packet Lookups Packet Matches Per Flow Received Packets Received Bytes Duration (Secs) Per Port Received Packets Transmitted Packets Received Bytes Per Queue Transmit Packets Transmit Bytes Transmit overrun errors Duration (nanosecs) Transmitted Bytes Receive Drops Transmit Drops Receive Errors Transmit Errors Receive Frame Alignment Errors Receive Overrun erorrs Receive CRC Errors Collisions Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-12 ©2013 Raj Jain
  • 13. Actions     Forward to Physical Port i or to Virtual Port:  All: to all interfaces except incoming interface  Controller: encapsulate and send to controller  Local: send to its local networking stack  Table: Perform actions in the flow table  In_port: Send back to input port  Normal: Forward using traditional Ethernet  Flood: Send along minimum spanning tree except the incoming interface Enqueue: To a particular queue in the port  QoS Drop Modify Field: E.g., add/remove VLAN tags, ToS bits, Change TTL Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-13 ©2013 Raj Jain
  • 14. Actions (Cont)        Masking allows matching only selected fields, e.g., Dest. IP, Dest. MAC, etc. If header matches an entry, corresponding actions are performed and counters are updated If no header match, the packet is queued and the header is sent to the controller, which sends a new rule. Subsequent packets of the flow are handled by this rule. Secure Channel: Between controller and the switch using TLS Modern switches already implement flow tables, typically using Ternary Content Addressable Memories (TCAMs) Controller can change the forwarding rules if a client moves  Packets for mobile clients are forwarded correctly Controller can send flow table entries beforehand (Proactive) or Send on demand (Reactive). OpenFlow allows both models. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-14 ©2013 Raj Jain
  • 15. Hardware OpenFlow Switches             Arista 7050 Brocade MLXe, Brocade CER, Brocade CES Extreme Summit x440, x460, x670 Huawei openflow-capable router platforms HP 3500, 3500yl, 5400zl, 6200yl, 6600, and 8200zl (the oldstyle L3 hardware match platform) HP V2 line cards in the 5400zl and 8200zl (the newer L2 hardware match platform) IBM 8264 Juniper (MX, EX) NEC IP8800, NEC PF5240, NEC PF5820 NetGear 7328SO, NetGear 7352SO Pronto (3290, 3295, 3780) - runs the shipping pica8 software Switch Light platform Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-15 ©2013 Raj Jain
  • 16. Software OpenFlow Switches       Indigo: Open source implementation that runs on physical switches and uses features of the ASICs to run OpenFlow LINC: Open source implementation that runs on Linux, Solaris, Windows, MacOS, and FreeBSD Pantou: Turns a commercial wireless router/access point to an OpenFlow enabled switch. OpenFlow runs on OpenWRT. Supports generic Broadcom and some models of LinkSys and TP-Link access points with Broadcom and Atheros chipsets. Of13softswitch: User-space software switch based on Ericsson TrafficLab 1.1 softswitch XORPlus: Open source switching software to drive high-performance ASICs. Supports STP/RSTP/MSTP, LCAP, QoS, VLAN, LLDP, ACL, OSPF/ECMP, RIP, IGMP, IPv6, PIM-SM Open vSwitch Ref: http://www.openvswitch.org/, http://www.projectfloodlight.org/indigo/, http://flowforwarding.github.io/LINC-Switch/, http://github.com/CPqD/openflow-openwrt, http://cpqd.github.io/ofsoftswitch13/, http://sourceforge.net/projects/xorplus http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis ©2013 Raj Jain 14-16
  • 17. Open vSwitch       Open Source Virtual Switch Nicira Concept Can Run as a stand alone hypervisor switch or as a distributed switch across multiple physical servers Default switch in XenServer 6.0, Xen Cloud Platform and supports Proxmox VE, VirtualBox, Xen KVM Integrated into many cloud management systems including OpenStack, openQRM, OpenNebula, and oVirt Distributed with Ubuntu, Debian, Fedora Linux. Also FreeBSD Ref: http://openvswitch.org/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-17 ©2013 Raj Jain
  • 18. Open vSwitch Features  Inter-VM communication monitoring via:  NetFlow: Cisco protocol for sampling and collecting traffic statistics (RFC 3954)  sFlow: Similar to NetFlow by sflow.org (RFC 3176)  Jflow: Juniper’s version of NetFlow  NetStream: Huawei’s version of NetFlow  IPFIX: IP Flow Information Export Protocol (RFC 7011) IETF standard for NetFlow  SPAN, RSPAN: Remote Switch Port Analyzer – port mirroring by sending a copy of all packets to a monitor port  GRE-tunneled mirrors: Monitoring device is remotely connected to the switch via a GRE tunnel Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-18 ©2013 Raj Jain
  • 19. Open vSwitch Features (Cont)            Link Aggregation Control Protocol (LACP) IEEE 802.1Q VLAN IEEE 802.1ag Connectivity Fault Management (CFM) Bidirectional Forwarding Detection (BFD) to detect link faults (RFC 5880) IEEE 802.1D-1998 Spanning Tree Protocol (STP) Per-VM traffic policing OpenFlow Multi-table forwarding pipeline IPv6 GRE, VXLAN, IPSec tunneling Kernel and user-space forwarding engine options Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-19 ©2013 Raj Jain
  • 20. OVSDB       Open vSwitch Database Management Protocol (OVSDB) Monitoring capability using publish-subscribe mechanisms Stores both provisioning and operational state Java Script Object Notation (JSON) used for schema format and for JSON-RPC over TCP for wire protocol (RFC 4627) Control and Mgmt Cluster <database-schema> OVSDB OpenFlow “name”: <id> OVSDB Server ovs-vswitchd “version”: <version> Forwarding Path “tables”: {<id>: <table-schema>,…} RPC Methods: List databases, Get Schema, Update, Lock, … Open vSwitch project includes open source OVSDB client and server implementations Ref: B. Pfaff and B. Davie, “The Open vSwitch Database Management Protocol,” IETF draft, Oct 2013, http://tools.ietf.org/html/draft-pfaff-ovsdb-proto-04 http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-20 ©2013 Raj Jain
  • 21. OpenFlow V1.1    V1: Perform action on a match. Ethernet/IP only. Single Path Did not cover MPLS, Q-in-Q, ECMP, and efficient Multicast V1.1 Introduced Table chaining, Group Tables, and added MPLS Label and MPLS traffic class to match fields. Table Chaining: On a match, instruction may be Controller OpenFlow  Immediate actions: modify packet, update match fields and/or Secure Group Channel Table  Update action set, and/or Flow Flow  Send match data and action set to Table n, Table Table  Go to Group Table entry n Table 1 Action Set = {} Washington University in St. Louis Table 2 Table 3 Table n Action Set = {1} http://www.cse.wustl.edu/~jain/cse570-13/ 14-21 Group Table Action Set = {1,3,6,…} ©2013 Raj Jain
  • 22. OpenFlow V1.1 (Cont)    On a miss, the instruction may be to send packet to controller or continue processing with the sequentially next table Group Tables: each entry has a variable number of buckets  All: Execute each bucket. Used for Broadcast, Multicast.  Select: Execute one switch selected bucket. Used for port mirroring. Selection may be done by hashing some fields.  Indirect: Execute one predefined bucket.  Fast Failover: Execute the first live bucket  Live port New Features supported:  Multipath: A flow can be sent over one of several paths  MPLS: multiple labels, traffic class, TTL, push/pop labels  Q-in-Q: Multiple VLAN tags, push/pop VLAN headers  Tunnels: via virtual ports Ref: http://archive.openflow.org/documents/openflow-spec-v1.1.0.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-22 ©2013 Raj Jain
  • 23. OpenFlow V1.2 1. 2. 3. IPv6 Support: Matching fields include IPv6 source address, destination address, protocol number, traffic class. ICMPv6 type, ICMPv6 code, IPv6 neighbor discovery header fields, and IPv6 flow labels. Extensible Matches: Type-Length-Value (TLV) structure. Previously the order and length of match fields was fixed. Experimenter extensions through dedicated fields and code points assigned by ONF Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.2.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis ©2013 Raj Jain 14-23
  • 24. OpenFlow 1.3          IPv6 extension headers: Can check if Hop-by-hop, Router, Fragmentation, Destination options, Authentication, Encrypted Security Payload (ESP), unknown extension headers are present MPLS Bottom-of-Stack bit matching MAC-in-MAC encapsulation Tunnel ID meta data: Support for tunnels (VxLAN, …) Per-Connection Event Filtering: Better filtering of connections to multiple controllers Many auxiliary connections to the controller allow to exploit parallelism Better capability negotiation: Requests can span multiple messages More general experimenter capabilities allowed A separate flow entry for table miss actions Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.3.0.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis ©2013 Raj Jain 14-24
  • 25. OpenFlow V1.3 (Cont)      Cookies: A cookie field is added to messages containing new packets sent to the controller. This helps controller process the messages faster than if it had to search its entire database. Duration: Duration field has been added to most stats. Helps compute rates. Per-flow counters can be disabled to improve performance Per Flow Meters and meter bands Meter: Switch element that can measure and control the rate of packets/bytes.  Meter Band: If the packet/byte rate exceeds a pre-defined Band 2 threshold  the meter has triggered the band Band 1  A meter may have multiple bands Time Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-25 ©2013 Raj Jain
  • 26. OpenFlow V1.3 (Cont)     If on triggering a band the meter drops the packet, it is called rate limiter. Other QoS and policing mechanisms can be designed using these meters Meters are attached to a flow entry not to a queue or a port. Multiple flow entries can all point to the same meter. Match Fields Priority Counters Instructions Timeouts Timeouts Cookie New Instruction: Meter Meter_ID Meter ID Meter Bands Counters Band Type Rate Counters Type Specific Arguments 1. Drop 2. Remark DSCP Washington University in St. Louis kb/s Burst http://www.cse.wustl.edu/~jain/cse570-13/ 14-26 ©2013 Raj Jain
  • 27. OpenFlow V1.4         Optical ports: Configure and monitor transmit and receive frequencies of lasers and their power Improved Extensibility: Type-Length-Value (TLV) encodings at most places  Easy to add new features in future Extended Experimenter Extension API: Can easily add ports, tables, queues, instructions, actions, etc. More information when a packet is sent to controller, e.g., no match, invalid TTL, matching group bucket, matching action, .. Controllers can select a subset of flow tables for monitoring Switches can evict entries of lower importance if table full Switches can notify controller if table is getting full Atomic execution of a bundle of instructions Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.4.0.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis ©2013 Raj Jain 14-27
  • 28. OpenFlow Evolution Summary MPLS, Q-in-Q Efficient multicast ECMP  Multiple Tables MAC-in-MAC Multiple channels between switch and controller Bug Fix Dec 2009 Feb 2011 Dec 2011 Apr 2012 Jun 2012 Sep 2012 Oct 2013 V1.0 V1.1 V1.2 V1.3 V1.3.1 V1.3.2 V1.4 Single Flow Table Ethernet/IPv4 Washington University in St. Louis IPv6 TLV matching Multiple controllers Bug Fix http://www.cse.wustl.edu/~jain/cse570-13/ 14-28 OTN Experimenters Bundles Table full ©2013 Raj Jain
  • 29. Bootstrapping      Switches require initial configuration: Switch IP address, Controller IP address, Default gateway Switches connect to the controller Switch provides configuration information about ports Controller installs a rule to forward LLDP responses to controller and then sends a LLDP request which is forwarded to all neighbors. Controller determines the topology from LLDP responses Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-29 ©2013 Raj Jain
  • 30. OpenFlow Configuration Protocol (OF-Config)   OpenFlow Control Point: Entity that configures OpenFlow switches OF-Config: Protocol used for configuration and management of OpenFlow Switches. Assignment of OF controllers so that switches can initiate connections to them:  IP address of controller OpenFlow OpenFlow  Port number at the controller Configuration Controller  Transport protocol: Point OpenFlow TLS or TCP OF-Config Protocol  Configuration of queues (min/max rates) and ports OpenFlow  Enable/disable receive/forward Switch Operational Context speed, media on ports Ref: Cisco, “An Introduction to OpenFlow,” Feb 2013, http://www.cisco.com/web/solutions/trends/open_network_environment/docs/cisco_one_webcastan_introduction_to_openflowfebruary142013.pdf Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-30 ©2013 Raj Jain
  • 31. OF-Config (Cont)   A physical switch = one or more logical switches each controlled by an OF Controller OF-Config allows configuration of logical switches. OpenFlow Configuration Point OpenFlow Controller OpenFlow Protocol OF-Config OF Capable Switch OF Logical Switch … OF Logical Switch Ref: ONF, “OpenFlow Management and Configuration Protocol (OF-Config 1.1.1),” March 23, 2013, https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1-1-1.pdf http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis ©2013 Raj Jain 14-31
  • 32. OF-Config Concepts         OF Capable Switch: Physical OF switch. Can contain one or more OF logical switches. OpenFlow Configuration Point: configuration service OF Controller: Controls logical switch via OF protocol Operational Context: OF logical switch OF Queue: Queues of packets waiting for forwarding OF Port: forwarding interface. May be physical or logical. OF Resource: ports, queues, certificates, flow tables and other resources of OF capable switches assigned to a logical switch Datapath ID: 64-ID of the switch. Lower 48-bit = Switch MAC address, Upper 16-bit assigned by the operator Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-32 ©2013 Raj Jain
  • 33. OF-Config Evolution     V1.0 (Jan 2012): Based on OpenFlow V1.2  Assign controllers to logical switches  Retrieve logical switch configurations  Configure ports and queues V1.1 (May 2012): Based on OpenFlow V1.3  Configuration of certificates  Capability Discovery: Retrieve logical switch capabilities  Configure logical tunnels (VXLAN, NVGRE, …) V1.1.1 (Jan 2013): Bug Fix. Versioning support V1.2 (Not published yet): Based on OpenFlow V1.4  Simple topology Detection  Assigning resources to logical switches Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config1dot0-final.pdf https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1.1.pdf https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-config-1-1-1.pdf Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-33 ©2013 Raj Jain
  • 34. OpenFlow Notification Framework Notification: Event triggered messages, e.g., link down  Publish/subscribe model: Switch = publisher. OpenFlow controller or OpenFlow config points, and others can subscribe. They will be notified about the events they subscribe.  Use ITU-T M.3702 Notifications: Attribute value change, Communication alarm, Environmental alarm, Equipment alarm, QoS alarm, Processing error alarm, Security alarm, State change, Object creation and deletion  Pre-existing Notifications: Do not fit in the framework but will be recognized.  OpenFlow: Packet-in, Flow removed, Port Status, Error, Hello, Echo request, Echo reply, Experimenter  OpenFlow Config: OpenFlow logical switch instantiation, OpenFlow capability switch capability change, Successful OpenFLow session establishment, Failed OpenFlow session establishment, Port failure or recovery Ref: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow-config/of-notifications-framework-1.0.pdf  Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-34 ©2013 Raj Jain
  • 35. Implementation Issues      40+ matching fields in a flow Multiple tables, each with a large number of flow entries Instructions and actions for each table Need VXLAN, NVGRE, etc. support For a large network, flow level programming can take a long time Table 0 Table 1 … Table n Group Table Logical Ports Port Management VxLAN NVGRE Physical Ports Ref: R. Oshana and S. Addepalli, “Networking Trends- Software Defined Networking, Network Virtualization and Cloud Orchestration,” Asia Power Arch. Conf, Oct 2012, https://www.power.org/wp-content/uploads/2012/10/13.-FSL-SDN-Openflow-and-Cloud-computing-UPD_Rob-Oshana.pdf Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-35 ©2013 Raj Jain
  • 36. OpenFlow: Future Work Items         Each controller has its own way to program. Need a common standard “Northbound API” No standard API for communication between controllers of overlapping domain  Need an East-West API Ability to continue operation when the controller is down Many other packet formats (non-IP, non-Ethernet, …) Flow  Decide once, use many times  Performance  But does not help non-flow based request/response apps Need API to encrypt data plane packets Need API to inject packets Need API to instantiate a service, such as a firewall, IDS, on the switch Ref: T. Nadeau and K. Gray, “SDN,” O’Reilly, 2013, 384 pp, ISBN:978-1-449-34230-2 http://www.cse.wustl.edu/~jain/cse570-13/ Washington University in St. Louis 14-36 ©2013 Raj Jain
  • 37. Summary 1. 2. 3. 4. 5. Four planes of Networking: Data, Control, Management, Service OpenFlow separates control plane and moves it to a central controller  Simplifies the forwarding element Switches match incoming packets with flow entries in a table and handle it as instructed. The controller supplies the flow tables and other instructions. Many hardware and software based switches including Open vSwitch OpenFlow has been extended to IPv4, MPLS, IPv6, and Optical Network. But more work ahead. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-37 ©2013 Raj Jain
  • 38. Reading List    S. Azodolmolky, "Software Defined Networking with OpenFlow," Packt Publishing, October 2013, 152 pp., ISBN:978-1-84969-872-6 (Safari Book) T. Nadeau and K. Gray, “SDN,” O’Reilly, 2013, 384 pp, ISBN:978-1-449-34230-2B (Safari Book) Pfaff and B. Davie, “The Open vSwitch Database Management Protocol,” IETF draft, Oct 2013, http://tools.ietf.org/html/draftpfaff-ovsdb-proto-04 Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-38 ©2013 Raj Jain
  • 39. References       N. McKeown, et al., ``OpenFlow: Enabling Innovation in Campus Networks," ACM SIGCOMM CCR, Vol. 38, No. 2, April 2008, pp. 69-74. ONF, “The OpenFlow Timeline,” http://openflownetworks.com/of_timeline.php Open Data Center Alliance Usage Model: Software Defined Networking Rev 1.0,” http://www.opendatacenteralliance.org/docs/Software_Defined_Networking _Master_Usage_Model_Rev1.0.pdf R. Oshana and S. Addepalli, “Networking Trends- Software Defined Networking, Network Virtualization and Cloud Orchestration,” Asia Power Arch. Conf, Oct 2012, https://www.power.org/wpcontent/uploads/2012/10/13.-FSL-SDN-Openflow-and-Cloud-computingUPD_Rob-Oshana.pdf ONF, "OpenFlow Specifications V1.0.0," http://archive.openflow.org/documents/openflow-spec-v1.0.0.pdf ONF, "OpenFlow Specifications V1.1.0," http://archive.openflow.org/documents/openflow-spec-v1.1.0.pdf Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-39 ©2013 Raj Jain
  • 40. References (Cont)          ONF, "OpenFlow Specifications V1.2.0," https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-spec-v1.2.pdf ONF, "OpenFlow Specifications V1.3.0," https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-spec-v1.3.0.pdf ONF, "OpenFlow Specifications V1.4.0," https://www.opennetworking.org/images/stories/downloads/sdnresources/onf-specifications/openflow/openflow-specv1.4.0.pdfhttp://openvswitch.org/ http://www.openvswitch.org/ http://www.projectfloodlight.org/indigo/ http://flowforwarding.github.io/LINC-Switch/ http://github.com/CPqD/openflow-openwrt http://cpqd.github.io/ofsoftswitch13/ http://sourceforge.net/projects/xorplus Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-40 ©2013 Raj Jain
  • 43. Acronyms                 ACL API ARP ASICs BFD BUM CFM CPU DFCA DSCP ECMP ESP FCAPS GRE ICMP ID Access Control List Application Programming Interface Address Resolution Protocol Application Specific Integrated Circuit Bidirectional Forwarding Detection Broadcast, Unknown, and Multicast Connectivity Fault Management Central Processing Unit Dynamic Frequency Channel Allocation Differentiated Service Control Point Equal Cost Multipath Encrytec Security Payload Fault, Configuration, Accounting, Performance and Security Generic Routing Encapsulation Internet Control Message Protocol Identifier Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-43 ©2013 Raj Jain
  • 44. Acronyms (Cont)                 IDS IEEE IETF IGMP IP IPFIX IPSec IPv4 IPv6 JSON KVM LACP LLDP MAC MAN MPLS Intrusion Detection System Institution of Electrical and Electronic Engineers Internet Engineering Task Force Internet Group Multicast Protocol Internet Protocol IP Flow Information Export Protocol IP Security Internet Protocol version 4 Internet Protocol version 6 Java Script Object Notation Kernel-based Virtual Machine Link Aggregation Control Protocol Link Layer Discovery Protocol Media Access Control Metropolitan Area Network Multiprotocol Label Switching Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-44 ©2013 Raj Jain
  • 45. Acronyms (Cont)                 NFV NVGRE OF ONF openQRM OpenWRT OSPF OTN OVSDB PIM-SM PIM QoS RAN RFC RIP RIP Network Function Virtualization Network Virtualization using Generic Routing Encapsulation OpenFlow Open Networking Foundation Open Qlusters Resource Manager Open WRT54G (Linksys product name) software Open Shortest Path First Optical Transport Network Open vSwitch Database Protocol Independent Multicast - Sparse Mode Protocol Independent Multicast Quality of Service Radio area networks Request for Comments IGMP, IPv6, PIM-SM Routing Information Protocol Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-45 ©2013 Raj Jain
  • 46. Acronyms (Cont)                   RPC RSPAN SDN SPAN SSL STP TCAM TCP TLS TLV ToS TTL TTP UDP VLAN VM VxLAN WG Remote Procedure Call Remote Switch Port Analyzer Software Defined Network Switch Port Analyzer Secure Socket Layer Spanning Tree Protocol Ternary Content Addressable Memory Transmission Control Protocol Transport Level Security Type-Length-Value Type of Service Time to Live Table Typing Patterns User Datagram Protocol Virtual Local Area Network Virtual Machine Virtual Extensible Local Area Network Working Group Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse570-13/ 14-46 ©2013 Raj Jain