1. Chapter 4 Network Layer: The Data Plane
A note on the use of these Powerpoint slides:
We’re making these slides freely available to all (faculty, students, readers). They’re in PowerPoint form so you see the animations; and can add, modify, and delete slides (including this one) and slide content to suit your needs. They obviously represent a lot of work on our part. In return for use, we only ask the following:
Computer Networking: A Top Down Approach
If you use these slides (e.g., in a class) that you mention their source (after all, we’d like people to use our book!)
If you post any slides on a www site, that you note that they are adapted from (or perhaps identical to) our slides, and note our copyright of this material.
Thanks and enjoy! JFK/KWR
All material copyright
J.F Kurose and K.W. Ross, All Rights Reserved
7th edition Jim Kurose, Keith Ross Pearson/Addison Wesley April 2016
Network Layer: Data Plane

2. Chapter 4: outline 4.1 Overview of Network layer data plane
control plane
4.4 Generalized Forwarding and SDN
match
action
OpenFlow examples of match-plus-action in action
Network Layer: Data Plane

3. Network layer transport segment from sending to receiving hosts
application
transport
network
data link
physical
transport segment from sending to receiving hosts
on sending side encapsulates segments into datagrams
on receiving side, delivers segments to transport layer
network layer protocols in every host & router
router examines header fields in all IP datagrams passing through it
network
data link
physical
application
transport
network
data link
physical
Network Layer: Data Plane

4. Two key network-layer functions
forwarding: move packets from router’s input to appropriate router output
routing: determine route taken by packets from source to destination
routing algorithms
analogy: taking a trip
forwarding: process of getting through single interchange
routing: process of planning trip from source to destination
Network Layer: Data Plane

5. Network layer: data plane & control plane
local, per-router function
determines how datagram arriving on router input port is forwarded to router output port
forwarding function
Control plane
network-wide logic
determines how datagram is routed among routers along end-end path from source host to destination host
two control-plane approaches:
traditional routing algorithms: implemented in routers
software-defined networking (SDN): implemented in (remote) servers 1 2 3
0111
values in arriving
packet header
Network Layer: Data Plane

6. Per-router control plane
Individual routing algorithm components in each and every router interact in the control plane
Routing
Algorithm
data
plane
control
values in arriving
packet header
0111 1 2 3
Network Layer: Control Plane

7. “Logically centralized” control plane
A distinct (typically remote) controller interacts with local control agents (CAs)
Remote Controller CA
data
plane
control
values in arriving
packet header 1 2
0111 3
Network Layer: Control Plane

8. Chapter 4: outline 4.1 Overview of Network layer data plane
control plane
4.4 Generalized Forwarding and SDN
match
action
OpenFlow examples of match-plus-action in action
Network Layer: Data Plane

9. Motivation
Proliferation of middleboxes that perform many layer-3 functions (except forwarding)
NAT: rewrite packet header’s IP address and port #
Firewall: block traffic based on header-field values
Load-balancer: forward packets requesting a given service to one of a set of servers
Proliferation of layer-2 switches and layer-3 routers
Each has its own specialized hardware, software, and management interface
A unified approach to provide many network-layer functions and certain link-layer functions in an integrated manner
Network Layer: Data Plane

10. Generalized Forwarding and SDN
Each router contains a flow (match+action) table that is computed and distributed by a logically centralized routing controller
logically-centralized routing controller
control plane
data plane
local flow table
headers counters actions
SDN switch or packet switch
vs.
layer 3 router or layer 2 switch 1 2 3
values in arriving
packet’s header
Network Layer: Data Plane

11. OpenFlow data plane abstraction
flow: defined by {header fields from different layers}
generalized forwarding: simple packet-handling rules
Pattern: match values in packet header fields
Actions (for matched packet): drop, forward, modify matched packet or send unmatched packet to controller
Priority: disambiguate overlapping patterns
Counters: #bytes and #packets
Flow table in a router (computed and distributed by controller) define router’s match+action rules
Network Layer: Data Plane

12. OpenFlow data plane abstraction
flow: defined by {header fields from different layers}
generalized forwarding: simple packet-handling rules
Pattern: match values in packet header fields
Actions (for matched packet): drop, forward, modify matched packet or send unmatched packet to controller
Priority: disambiguate overlapping patterns
Counters: #bytes and #packets
* : wildcard
src=1.2.*.*, dest=3.4.5.*  drop
src = *.*.*.*, dest=3.4.*.*  forward(2)
3. src= , dest=*.*.*.*  send to controller

13. Match+Action Destination based vs. generalized forwarding
Network-wide collection of per-packet switch matching rules implements a wide range of functions
layer 3 routing
layer 2 switching
NAT
firewalling
load-balancing
virtual networks

14. OpenFlow: Flow Table Entries
Rule
Action
Stats
packet + byte counters
Forward packet to port(s)
Encapsulate and forward to controller
Drop packet
Send to normal processing pipeline
Modify Fields
Now I’ll describe the API that tries to meet these goals.
Switch
Port ID
VLAN ID
MAC
src
MAC
dst
Eth
type IP
Src IP
Dst IP
Prot
TCP
sport
TCP
dport
Link layer
Network layer
Transport layer 14

15.
Network Layer

16. Examples Destination-based forwarding: Firewall:
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Action * * * * * * * * *
port6
IP datagrams destined to IP address should be forwarded to router output port 6
Firewall:
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Forward * * * * * * * * * 22
drop
do not forward (block) all datagrams destined to TCP port 22
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Forward
drop * * * * * * * * *
do not forward (block) all datagrams sent by host

17. Examples Destination-based layer 2 (switch) forwarding:
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Action *
22:A7:23:
11:E1:02 * * * * * * * *
port3
layer 2 frames from MAC address 22:A7:23:11:E1:02 should be forwarded to output port 3
Network Layer: Data Plane

18. OpenFlow abstraction match+action: unifies different kinds of devices
Router (layer 3)
match: longest destination IP prefix
action: forward out a link
Switch (layer 2)
match: destination MAC address
action: forward or flood
Firewall
match: IP addresses and/or TCP/UDP port numbers
action: permit or deny
NAT
match: IP address and port
action: rewrite address and port
Network Layer: Data Plane

19. OpenFlow example (1)
Example: datagrams from hosts h5 or h6 destined to h3 or h4 should be sent via s1 to s2
IP Src = 10.3.*.*
IP Dst = 10.2.*.*
forward(3)
match
action
Host h6
controller 1 s3 2 4 3
Host h5 s1 1 s2 1 2
Host h4 4 2 4
ingress port = 2
IP Dst =
IP Dst =
forward(3)
match
action
forward(4)
ingress port = 1
IP Src = 10.3.*.*
IP Dst = 10.2.*.*
forward(4)
match
action
Host h1 3 3
Host h2
Host h3

20. OpenFlow example (2)
Load balancing: datagrams from h3 destined to 10.1.*.* are to be forwarded over the link between s2 and s1; datagrams from h4 destined to 10.1.*.* are to be forwarded over the link between s2 and s3 (and the from s3 to s1)
Ingress port = 4
IP Src = 10.2.*.*
IP Dst = 10.1.*.*
forward(3)
match
action
Host h6
controller 1 s3 2 4 3
Host h5 s1 1 s2 1 2
Host h4 4 2 4
ingress port = 3
IP Dst = 10.1.*.*
ingress port = 4
forward(2)
match
action
forward(1)
IP Dst =
IP Dst =
forward(2)
forward(3)
match
action
Host h1 3 3
Host h2
Host h3

21. OpenFlow example (3)
Firewall: s2 wants only to receive (on any of its interfaces) traffic sent from hosts attached to s3
Host h6
controller 1 s3 2 4 3
Host h5 s1 1 s2 1 2
Host h4 4 2 4
Host h1
IP Src = 10.3.*.*
IP Dst =
IP Dst =
forward(3)
match
action
forward(4) 3 3
Host h2
Host h3

22. Data Plane: done!
4.1 Overview of Network layer: data plane and control plane
4.4 Generalized Forward and SDN
match plus action
OpenFlow example
Question: how do forwarding tables (destination-based forwarding) or flow tables (generalized forwarding) computed? Answer: by the control plane (next chapter)
Network Layer: Data Plane

23. Chapter 5 Network Layer: The Control Plane
A note on the use of these Powerpoint slides:
We’re making these slides freely available to all (faculty, students, readers). They’re in PowerPoint form so you see the animations; and can add, modify, and delete slides (including this one) and slide content to suit your needs. They obviously represent a lot of work on our part. In return for use, we only ask the following:
Computer Networking: A Top Down Approach
If you use these slides (e.g., in a class) that you mention their source (after all, we’d like people to use our book!)
If you post any slides on a www site, that you note that they are adapted from (or perhaps identical to) our slides, and note our copyright of this material.
Thanks and enjoy! JFK/KWR
All material copyright
J.F Kurose and K.W. Ross, All Rights Reserved
7th edition Jim Kurose, Keith Ross Pearson/Addison Wesley April 2016
Network Layer: Control Plane

24. Recall: per-router control plane
Individual routing algorithm components in each and every router interact with each other in control plane to compute forwarding tables
Routing
Algorithm
data
plane
control
Network Layer: Control Plane

25. SDN logically centralized control plane
A distinct (typically remote) controller interacts with local control agents (CAs) in routers to compute forwarding tables
Remote Controller CA
data
plane
control
Network Layer: Control Plane

26. Software defined networking (SDN)
Why a logically centralized control plane?
easier network management: avoid router misconfigurations, greater flexibility of traffic flows
table-based forwarding (recall OpenFlow API) allows “programmable” routers
centralized “programming” easier: compute tables centrally and distribute flow tables
distributed “programming” more difficult: compute tables as result of distributed algorithm (protocol) implemented in each and every router
open (non-proprietary) implementation of control plane
Network Layer: Control Plane

27. Analogy: mainframe to PC evolution*
App
Specialized
Applications
Linux
Mac OS
Windows
(OS) or
Open Interface
Specialized
Operating
System
Microprocessor
Open Interface
Specialized
Hardware
horizontal
open interfaces
rapid innovation
huge industry
vertically integrated
closed, proprietary
➡slow innovation,
small industry
* Slide courtesy: N. McKeown
Network Layer: Control Plane

28. Traffic engineering: difficult with traditional routing5 3 v w 5 2 u 2 1 z 3 1 2 x y 1
Q: what if network operator wants u-to-z traffic to flow along uvwz, x-to-z traffic to flow xwyz?
A: need to define link weights so traffic routing algorithm computes routes accordingly (or need a new routing algorithm)!
Note: implicit assumption here: destination based forwarding
Link weights are the only control “knobs”: wrong!
Network Layer: Control Plane

29. Traffic engineering: difficult2 1 3 5 v w u z y x
Q: what if network operator wants to split u-to-z traffic along uvwz and uxyz (load balancing)?
A: cannot do it (or need a new routing algorithm)
Note: implicit assumption here: destination based forwarding
Network Layer: Control Plane

30. Traffic engineering: difficult
Networking 401
Traffic engineering: difficult 5 v 3 w v w 5 2 u z 2 z 1 3 1 x x y 2 y 1
Q: what if w wants to route blue and red traffic differently?
A: cannot do it (with destination based forwarding, and LS, DV routing)
Note: implicit assumption here: destination based forwarding
Network Layer: Control Plane

31. Software defined networking (SDN)
4. programmable control applications …
3. control plane functions external to data-plane switches
routing
access control
load
balance
data
plane
control
Remote Controller CA
2. control, data plane separation
1: generalized “flow-based” forwarding (e.g., via OpenFlow)
Network Layer: Control Plane

32. SDN perspective: data plane switches
fast, simple, commodity switches implementing generalized data-plane forwarding (Section 4.4) in hardware
switch flow table computed, installed by controller
API for table-based switch control (e.g., OpenFlow)
defines what is controllable and what is not
protocol for communicating with controller (e.g., OpenFlow)
data
plane
control
SDN Controller
(network operating system) …
routing
access
load
balance
southbound API
northbound API
SDN-controlled switches
network-control applications
Network Layer: Control Plane

33. SDN perspective: SDN controller
SDN controller (network OS):
maintain network state information
interacts with network control applications “above” via northbound API
interacts with network switches “below” via southbound API
implemented as distributed system for performance, scalability, fault-tolerance, robustness
network-control applications …
routing
access
control
load
balance
control
plane
northbound API
SDN Controller
(network operating system)
southbound API
data
plane
SDN-controlled switches
Network Layer: Control Plane

34. SDN perspective: control applications
network-control apps:
“brains” of control: implement control functions using lower-level services, API provided by SDN controller
unbundled: can be provided by 3rd party: distinct from routing vendor, or SDN controller
network-control applications …
routing
access
control
load
balance
control
plane
northbound API
SDN Controller
(network operating system)
southbound API
data
plane
SDN-controlled switches
Network Layer: Control Plane

35. Components of SDN controller
routing
access
control
load
balance
Interface layer to network control apps: abstractions, API
Interface, abstractions for network control apps …
network graph
RESTful
API
intent
Network-wide state management layer: state of networks’ hosts, links, switches, services: a distributed database/servers …
statistics
flow tables
SDN
controller
Network-wide distributed, robust state management …
Link-state info
host info
switch info …
communication layer: communicate between SDN controller and controlled switches
OpenFlow
SNMP
Communication to/from controlled devices
Network Layer: Control Plane

36. OpenFlow protocol operates between controller and switch
TCP used (port # 6653) to exchange messages
optional encryption
three classes of OpenFlow messages:
controller-to-switch
asynchronous (switch to controller)
symmetric (misc)
OpenFlow Controller
Network Layer: Control Plane

37. OpenFlow: controller-to-switch messages
Key controller-to-switch messages
read-state: controller collects statistics and counter values from flow tables and ports
configuration: controller queries/sets switch configuration parameters
modify-state: add, delete, modify flow table entries in switch; set switch port properties
send-packet (packet-out): controller can send contents of this packet out of specific switch port
OpenFlow Controller
Network Layer: Control Plane

38. OpenFlow: switch-to-controller messages
Key switch-to-controller messages
packet-in: transfer (unmatched) packet (and its control) to controller. Vs. packet-out message from controller
flow-removed: flow table entry deleted at switch
port-status: inform controller of a status change on a port.
OpenFlow Controller
Fortunately, network operators do not “program” switches by creating/sending OpenFlow messages directly. Instead, use higher-level abstraction at controller
Network Layer: Control Plane

39. Dijkstra’s link-state
SDN: control/data plane interaction example
S1, experiencing link failure using OpenFlow port-status message to notify controller 1
Dijkstra’s link-state
Routing 4 … 5
network graph
RESTful
API
intent
SDN controller receives OpenFlow message, updates link status info 2 3 …
statistics
flow tables …
Dijkstra’s routing algorithm application has previously registered to be called when ever link status changes. It is called. 3
Link-state info
host info
switch info 2 …
OpenFlow
SNMP
Dijkstra’s routing algorithm access network graph info, link state info in controller, computes new routes 4 6 1 s2 s1 s4 s3
Network Layer: Control Plane

40. Dijkstra’s link-state
SDN: control/data plane interaction example
Dijkstra’s link-state
Routing 4 … 5
network graph
RESTful
API
intent
link state routing app interacts with flow-table-computation component in SDN controller, which computes new flow tables needed 5 3 …
statistics
flow tables …
Link-state info
host info
switch info 2
Controller uses OpenFlow to install new tables in switches that need updating 6 …
OpenFlow
SNMP 6 1 s2 s1 s4 s3
Network Layer: Control Plane

41. OpenDaylight (ODL) controller
Traffic
Engineering …
ODL Lithium controller
network apps may be contained within, or be external to SDN controller
Service Abstraction Layer: interconnects internal, external applications and services
REST API
Network service apps
Basic Network Service Functions
topology
manager
switch
manager
stats
manager
Access
Control
forwarding
manager
host
manager
Service Abstraction Layer (SAL) …
OpenFlow 1.0
SNMP
OVSDB
Network Layer: Control Plane

42. ONOS controller … control apps separate from controller
Network
control apps
control apps separate from controller
intent framework: high-level specification of service: what rather than how
considerable emphasis on distributed core: service reliability, replication performance scaling
northbound abstractions,
protocols
REST API
Intent
hosts
paths
flow rules
topology
ONOS
distributed core
devices
links
statistics
device
link
host
flow
packet
southbound abstractions,
protocols
OpenFlow
Netconf
OVSDB
Network Layer: Control Plane

43. SDN: challenges
hardening the control plane: dependable, reliable, performance-scalable, secure distributed system
robustness to failures: leverage strong theory of reliable distributed system for control plane
dependability, security: “baked in” from day one?
networks, protocols meeting mission-specific requirements
e.g., real-time, ultra-reliable, ultra-secure
Internet-scaling
Network Layer: Control Plane