Software Defined Networking Nick McKeown Stanford University

(part 1) My talk will be in three parts. I want to keep you on your toes, so I’m not going to tell you what the 2nd and 3rd parts are yet. To get the ball rolling, I thought I’d start by telling you a little bit about what I do.

Why I love my job I work with people much smarter than me. I get to work on intellectually interesting ideas. … that might positively change the practice. Then, we try to actually change the practice.

Whatever it takes Prove a theorem Write a paper Build a demo Talk to lots of industry people Write a standard Give lots of talks Write a blog Start a company Build an open source tool …

Choosing research projects Pick a problem that is intellectually interesting. And improves the practice. And industry doesn’t like (yet).

Ethane Martin Casado et al [Sigcomm ‘07] Policy “Laptops can’t accept incoming connections” “A can’t talk to B” Network Control Plane Control Packet Forwarding Packet Forwarding Packet Forwarding Packet Forwarding Packet Forwarding

Microsoft: “Come on in….” Cisco: “It will never work…” Raw nerve. We must be onto something.

Checklist Intellectually interesting. And improves the practice. And industry doesn’t like (yet).

Corollary: You can’t give stuff away Example 1: Order of magnitude faster router (1997) Tried to give Tiny-Tera away for free. Industry wasn’t ready. Started Abrizio. Example 2: Network Memory (2001) Tried to give it away for free, to save $500M per year. Started Nemo. Example 3: Ethane (2007) Tried to give it away for free; early stages of SDN. Started Nicira.

I put everything in public domain Industry Invests huge amounts to develop and sell products. Patents protect ideas, giving the confidence to invest. University research Serves society at large. Stay ahead by running fast, not by protecting. Makes it easier to work with industry. If it’s good research, industry doesn’t see it yet. Everything in public domain since 1999.

(part 2) In part 2 of my talk I’m going to tell you about software defined networking. What it is, what it isn’t. What are the technical consequences and what will be some of the business consequences.

Urs Hölzle (Google), ONS 2012 If you are in any doubt about whether OpenFlow/SDN will be deployed in the WAN Urs Hölzle (Google), ONS 2012

Software Defined Networks Martin Casado

(when we clear away all the hype) What is SDN? (when we clear away all the hype)

SDN is the separation of the control plane from the forwarding plane.

Software Defined Network (SDN) Control Program Control Program Control Program Global Network Map Network OS Packet Forwarding Abstract Forwarding Model (e.g. OpenFlow) Packet Forwarding Packet Forwarding Packet Forwarding Packet Forwarding

The Technical Benefits (1) Well-defined control abstraction Control plane can run on modern servers Can adopt software engineering best-practices Easier to add new control programs …or customize locally Solve distributed systems problem once, rather than for every protocol

OSPF OSPF Dijkstra Network OS OS Dijkstra 5% 95% Specialized Hardware Packet Forwarding Global Network Map Network Map 95% OS Specialized Hardware

The Technical Benefits (2) Well-defined forwarding abstraction e.g. OpenFlow Vendor-agnostic interface to forwarding plane Simpler, lower-cost, lower-power hardware

Match-Action Forwarding Abstraction “Plumbing primitives” Action Primitives “Forward to ports 4 & 5” “Push header Y after bit 12” “Pop header bits 8-12” “Decrement bits 13-18” “Drop packet” … H H’ Match Action F Action(F) G Action(G) H Action(H)

Multiple Table Match-Action Hn H1 H’ \ Match Action F1 Action(F) G1 Action(G) H1 Action(H) Match Action Fn Action(F) Gn Action(G) Hn Action(H)

OpenFlow Philosophy Long-term, forwarding looking Match: Very general, not protocol specific. Action: Small instruction set, not protocol specific. Make it easy to add new headers and actions. Any network (packet, circuit, radio). Short-term, backward looking Match: include well-known header fields. Action: necessary set for existing protocols. Support existing protocols on existing switch chips.

New switch chips emerging Match Table Action Match Table Action H Output Queues HEADER In Out Data H Data H Recombine DATA

The Technical Benefits (3) Well-defined forwarding behavior The forwarding tables capture the entire forwarding behavior. Control plane writes the forwarding state. Therefore, we can verify its correctness.

Software Defined Network (SDN) firewall.c … if( TCP_port == SMTP) dropPacket(); Control Program Control Program Control Program Global Network Map Network OS Match Action A Action(A) B Action(B) C Action(C) Match Action A Action(A) G Action(G) H Action(H) Packet Forwarding Packet Forwarding Match Action X Action(X) Y Action(Y) Z Action(Z) Match Action F Action(F) G Action(G) H Action(H) Packet Forwarding Packet Forwarding Match Action A Action(A) G Action(G) D Action(D) Packet Forwarding

Software Defined Network (SDN) 1 firewall.c … if( TCP_port == SMTP) dropPacket(); Control Program Control Program Control Program Global Network Map 2 Network OS Match Action A Action(A) B Action(B) C Action(C) Match Action A Action(A) G Action(G) H Action(H) Packet Forwarding Packet Forwarding 3 Match Action X Action(X) Y Action(Y) Z Action(Z) Match Action F Action(F) G Action(G) H Action(H) Packet Forwarding Packet Forwarding Match Action A Action(A) G Action(G) D Action(D) Packet Forwarding

Software Defined Network (SDN) “A can talk to B” “Guests can’t reach PatientRecords” “No loops” Policy Control Program Control Program Control Program Global Network Map Network OS Match Action A Action(A) B Action(B) C Action(C) Match Action A Action(A) G Action(G) H Action(H) Packet Forwarding Packet Forwarding Match Action X Action(X) Y Action(Y) Z Action(Z) Forwarding Behavior Match Action F Action(F) G Action(G) H Action(H) Packet Forwarding Packet Forwarding Match Action A Action(A) G Action(G) D Action(D) Packet Forwarding

Networks notoriously hard to debug Today, even simple questions hard to answer: Can host A talk to host B? What are all the packet headers from A that can reach B? Are there any loops in the network? Is Group X provably isolated from Group Y? What happens if I remove a line in the config file?

Header Space Analysis A B Header Data Header Data L 01110011…1 111..100000

Header Space Analysis 1 2

The set of packets from A that can reach B

All packets from A that can reach B

Header Space Analysis [Kazemian NSDI ‘12] Consequences Abstract forwarding model; protocol independent Finds all packets from A that can reach B Find loops, regardless of protocol or layer Can prove that two groups are isolated Can verify if network adheres to policy

HSA as a “foundation” Analogy to Boolean algebra for logic design HSA enables many tools and methods Independent static checking In-line in-controller invariance checking Dynamic testing: Automatic test packet generation Dynamic testing: Automatic performance monitoring Analogy to Boolean algebra for logic design

SDN: Business Consequences

The Business Consequences Vertical integration will finally be replaced by a more competitive industry with a level playing field. Large growth in software industry for networking. Faster innovation. Hardware switches will focus on capacity, fan-out and power. (Think Intel for networking). Multi $Bn tools industry will emerge.

Corollary The customer and end-user will be better served Networks will be cheaper. Networks will be faster. Networks will be (much) more reliable. Networks will improve faster. Networks will be in service of the owner, the operator, the customer and the application rather than just the high-margin vendor. SDN is in the best interest of society at large. To resist is to be protectionist and self-serving.

Vertically integrated App Specialized Applications Linux Mac OS Windows (OS) or Open Interface Specialized Operating System Microprocessor Open Interface Specialized Hardware Vertically integrated Closed, proprietary Slow innovation Small industry Horizontal Open interfaces Rapid innovation Huge industry

Vertically integrated App Specialized Features Control Plane or Open Interface Specialized Control Plane Merchant Switching Chips Open Interface Specialized Hardware Vertically integrated Closed, proprietary Slow innovation Horizontal Open interfaces Rapid innovation

Tens of millions of lines of code. Closed, proprietary, outdated. Specialized Features Hundreds of protocols 6,500 RFCs Specialized Control Plane Tens of millions of lines of code. Closed, proprietary, outdated. Specialized Hardware Billions of gates. Power hungry and bloated.

“My box now has an OpenFlow interface too!” What SDN isn’t Ram in even more lines of code… “My box now has an OpenFlow interface too!”

(part 3)

What’s new? Separation of control from forwarding. Programmatic control of forwarding by writing entries into tables. Transport networks have done this for decades!

Natural Evolution: Converged Control Program Control Program Control Program Global Network Map Network OS Direct Control of Hardware, or Virtual transport network Control Data Center Data Center Transport Network MPLS MPLS New ONF Working Group: Optical Transport

Match-Action Forwarding Abstraction OpenFlow OpenFlow Packet flow Circuit/channel Packet flow Match Action F Action(F) G Action(G) Match Action F Action(F) G Action(G) OpenFlow Circuit/channel Match Action F Action(F) G Action(G)

Dynamic Circuit Switching Transport Network Packet Network Packet Network Transport Network UNI UNI

Why it was supposed to happen Technology: High capacity optical crossconnects. Aggregation: High capacity packet networks. Cost: Circuit switches cost less; use less power. Standard: GMPLS.

Why GMPLS failed Router vendors prevented it. GMPLS standard much too complicated.

OSPF-TE, RSVP-TE + many more Packet Network Transport Network IP/MPLS Control Plane OSPF-TE, RSVP-TE + many more GMPLS Control Plane OSPF-TE, RSVP-TE EMS EMS EMS Proprietary Interface UNI Vendor Islands We Didn’t Make it Easy! 49

OSPF-TE, RSVP-TE + many more Packet Network Transport Network IP/MPLS Control Plane OSPF-TE, RSVP-TE + many more GMPLS Control Plane OSPF-TE, RSVP-TE OSPF-TE, RSVP-TE OSPF-TE, RSVP-TE EMS EMS EMS Proprietary Interface UNI Vendor Islands GMPLS OSPF RSVP 175k Quagga 50k Linux 50

Good Architecture Simplifies 3% as much code! Aggregation Dynamic Bandwidth Recovery 4.7k Global Network Map 68k Network OS NOX Linux Quagga Linux OSPF RSVP 50k 175k GMPLS Packet Network Packet Network Transport Network

Conclusions SDN is here to stay: It introduces the right abstractions into network control. It will sweep away protectionist practices, and level the playing field. It will enable converged control of packet and transport networks. I don’t recommend sitting on the sidelines.

Apps Specialized Features Specialized Control Plane Specialized Hardware

Apps Network OS Specialized Control Plane Simpler Hardware Specialized Hardware