Flowlnsight: Decoupling Visibility from Operability in SDN Data Plane

摘要

In most designs of SDN scenarios, there is only one flow table in each switch, e.g. OpenFlow 1.0. Even with the adoption of multiple flow tables in later versions of Open-Flow, this feature is still not widely used. In the current design of OpenFlow, a controller has two ways to get the view of a flow: 1) the controller passively learns a flow if the flow is mismatched in the flow table; 2) the controller proactively pulls the counters of each rule. If only one flow table is used, whether the controller can see a flow is wholly determined by the flow table, i.e. the visibility is coupled to the operability. However, the coupling has the following problems: Invisible flows. The first packet of the flows may be required by some applications to learn the flows, but gets lost due to the limitation of the design. For example (Figure l(a)), a wildcard rule installed by a forwarding application will mask all the matched micro-flows which should be visible to a firewall application. To ensure every micro-flow can be seen by the controller, Frenetic installs an exact-match rule after each micro-flow's arrival instead of installing wildcard rules in advance, while introducing significant latency in forwarding.