OpenFlow: Enabling Innovation in Campus Networks ACM SIGCOMM Computer Communication Review 2008 Nick McKeown Tom Anderson Hari Balakrishnan Stanford University University of Washington MIT Guru Parulkar Larry Peterson Jennifer Rexford Princeton University Scott Shenker Jonathan Turner University of California, Berkeley Washington University in St. Louis 101064541 葉幸宜 2013/5/30

Outlines Introduction and Motivation OpenFlow Conclusion Goal Concepts Network Architecture Flow Table Structure Controller More Examples Conclusion 2013/5/30

Introduction and Motivation Experiments we’d like to do Mobility Management New Naming/Addressing Schemes Network Access Control If we design our own prototypes … Closed network No way to test the prototypes 現在的網路還是有很多值得改善的地方， 像是改善手機換手的方法， 用一個新的protocol取代IP， 或是用新的方法去做network access control的問題。 但是，當我們研發出新的prototype時， 因為現在網路是封閉的， 沒有辦法讓我們把prototype實際load到真正的網路上做測試， 都只能在實驗室跑模擬， 所以往往這些prototype都是未經測試的， 不知道它的實際效能還有可靠性。 2013/5/30

Introduction and Motivation Why Internet is closed for innovations? Commercial vendor won’t open software and hardware development environment Complexity to support Market protection & Barrier-to-entry for competitors Existing Solutions Software only Performance is not good Hardware/Software Fanout too small 那為什麼我們的網路會是封閉的呢? 因為網路供應商不希望這些實驗的封包在他們的機器上跑， 他們怕這些prototype沒有設計好，會讓整個網路當掉。 第二個點是因為他們不希望公開他們產品內部的設計，有商業上的原因。 那現在能測試prototype的方法大致上有兩種。 第一種是用軟體去模擬結果， 但這樣子太慢了。 第二種是結合hardware/software的機器， 但他的port太少了， 沒有辦法反映到真正網路的狀況。 2013/5/30

OpenFlow Goal Open Platform Bring future Internet to legacy Internet For researchers to test new ideas at scale production networks Without requiring vendors to expose internal workings Bring future Internet to legacy Internet 所以呢，就有openflow的誕生。 它的目的是提供一個open的平台， 讓researchers能夠透過openflow protocol定義好的format， 實際在真實網路上控制，測試他們的prototype。 除了這個目的之外，openflow設計的架構， 也不需要這些網路供應商公開他們內部的設計， 也不會影響到原本網路的運作。 這樣就可以在舊有網路中研發新的架構。 2013/5/30

OpenFlow Protocol (SSL) Software  Control Plane OpenFlow’s Concept OpenFlow Controller OpenFlow Protocol (SSL) Ethernet Switch Software  Control Plane Control Plane OpenFlow Openflow 是架構在Ethernet switch上的。 原本的switch分成control plane 和 data plane。 Control plane就是設定一些rules， 讓data plane跟去這些rules對封包做處理。 那Openflow最主要的概念就是他讓researcher透過controller， 可以自訂rules，去控制封包的走向， 而且不會動到原本的封包。 Hardware  Data Plane Hardware  Data Plane 2013/5/30

OpenFlow Network Architecture OpenFlow Switch specification OpenFlow-enable Commercial Switch OpenFlow Protocol PC Normal Software Secure Channel SSL SW OpenFlow Controller Normal Datapath Flow Table HW 2013/5/30

OpenFlow Flow Table Structure OpenFlow Switch Rule Action Statistics Normal Software Secure Channel SW HW Normal Datapath Flow Table Packet + byte counters Forward packet to port(s) Encapsulate and forward to controller Drop packet Send to normal processing pipeline Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport 2013/5/30

OpenFlow Flow Table Structure OpenFlow Switch Rule Action Statistics Normal Software Secure Channel SW HW Normal Datapath Flow Table Packet + byte counters Forward packet to port(s) Encapsulate and forward to controller Drop packet Send to normal processing pipeline Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport 2013/5/30

OpenFlow Flow Table Example Ethernet Switching IP Routing Application Firewall Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * 00:2D.. * * * * * * * Port5 Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * * * * * 140.114.. * * * Port3 Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action * * * * * * * * * 22 Drop 2013/5/30

OpenFlow Controller Centralized intelligential agency Allow multiple researchers create their accounts to control the flows independently Add or remove flow-entries NOX is an open-source OpenFlow Controller NOX Controller OpenFlow Switch OpenFlow Switch OpenFlow Switch 2013/5/30

Secure Channel SSL Connection Controller discovery protocol Encapsulate packets for controller Send link/port state to controller 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! Rules Rules Rules Rules OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Amy OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Bob OpenFlow Switch Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

OpenFlow Operation Example Amy Access Control Scheme! If Rule = x, send to port 4 If Rule = y, drop it If Rule = ?, send to controller Else, send to normal pipeline Bob OpenFlow Switch Flow Table O-Flow Table PC Controller Flow Table OpenFlow Switch OpenFlow Switch Flow Table OpenFlow Switch Flow Table 2013/5/30

More Examples for OpenFlow Switch Port MAC src MAC dst Eth type VLAN ID IP Src IP Dst IP Prot TCP sport TCP dport Action Network Management and Access Control Ex: Phones can only use HTTP service VLANs Mobile wireless VoIP clients Allowing seamless handover Non-IP network OpenFlow packets could be any kinds of formats Processing packets rather than flows 2013/5/30

OpenFlow Products NEC HP Pronto 2013/5/30 13/14

Conclusion OpenFlow Standard way to control flow-tables in commercial switches and routers An open development environment for all researchers Real environment for Future Internet Technologies 2013/5/30