3. Expensive bugsFrequent protocol changes Operators don’t have the full picture

6. Speed Expressivity Hassel, Veriflow NetPlumber Network Optimized Datalog (NoD) Model checkers, SAT Solvers, Datalog Margrave

8. Policy TemplateExample Protection Sets Customer VMs cannot access controllers Reachable SetsCustomer VMs can access other VMs Consistency ECMP/Backup routes should have identical reachability Middlebox Forward path connections through middlebox should reverse Locality Packets between two hosts in the same cluster should stay within the cluster

9. Solution

18. Evaluation

23. Model Checker SMT All Solutions NoDHSA Stanford Unreach 12.20.12.1 0.1 Stanford Reachable 13.711215.9 0.9 Stanford Loop 11.72903.90.2 CloudTime out 15.7- Cloud 28.5Time out4.8-