Flow-level consistent update in SDN based on K-prefix ... - IEEE Xplore

Globecom 2014 - Next Generation Networking Symposium

Flow-level consistent update in SDN based on K-prefix covering Kun Zhao, Qing Li, Yong Jiang Graduate School at Shenzhen, Tsinghua University, Guangdong, China Email: [email protected], [email protected], [email protected]

Abstract—In Software Defined Networks (SDN), the configuration inconsistency during updates is one main source of network instability. Even if the validity of the initial and final configurations is guaranteed, the interim complex and inconstant network states might cause routing conflicts and transmission disruption. Therefore, an efficient updating scheme of configuration consistency is required. Current schemes solve the problem of packet-level configuration consistency very well, but perform poorly for flow-level configuration consistency. In this paper, we provide a new scheme to guarantee flow-level consistency during configuration updates in SDN. In our scheme, the controller 1) collects the existing flow information; 2) computes K optimal prefixes covering the existing flows; 3) installs the new rule and K old sub-rules with lower and higher priorities respectively. We design the K-prefix covering algorithm by dynamic programming, which computes the K optimal prefixes with the minimum covering space. Therefore, the new rules will be activated for the maximum space. We evaluate our scheme and algorithm by comprehensive experiments. The results show that our scheme reduces the transition time to 10% of the current periodical direct division scheme.

I. I NTRODUCTION As a distributed system, the network is complicated and volatile, i.e., the topology and the traffic change with time going. Operators update the configuration to maintain network stability and provide reliable service. They modify the forwarding policies, adjust the link weights and allocate traffic among the network devices. Even if the static configurations are valid, numbers of pathological states are inevitable during the dynamic changes [1, 2]. In a traditional network, updates of routes are independent and asynchronous among the forwarding devices when network events occur. The behaviors of the network are indefinite and uncontrollable. As a future network architecture, Software-Defined Networking (SDN) [3] employs the approach of centralized controlling, and thus mitigates the problem of anomalies between network changes. SDN decouples the forwarding panel and the control panel, centralizes the intelligence of the network into the controller. The controller determines the global routing policies and disseminates them to the switches. However, the controller still can not ensure synchronous updates in the switches. As the network environment is extremely complicated, the updates’ installation times in different switches are unpredictable. Therefore, the configurations in different switches might be inconsistent before the update is installed in the whole network, which may cause forwarding loops, packet

978-1-4799-3512-3/14/$31.00 ©2014 IEEE

dropping, service disruption, etc. The problem to be solved is ensuring that each packet (or flow) is handled by the same configuration (the old one or the new one, but not the mixed) in the SDN network. To address this problem, researchers have proposed some protocols and methods which aim to prevent transient anomalies. A safe protocol [4] is suggested that the packets affected by the network change should be sent to the controller, and then be re-leased to the network after the change terminates. The two-phase updating scheme based on version controlling introduced in [5] solves the problem of packetlevel configuration consistency in SDN very well. However, the periodical division approach it employs is inefficient for flow-level consistent updating. Katta, et al., propose another scheme of incremental consistent updates [6]. An update is divided into m rounds and in each round a part of traffic is transferred to the new configuration, which reduces the rule space required with the overhead of an increased updating time. Hong, et al., use a series of intermediate configurations to satisfy the rule space and bandwidth constraints during network changes [7]. The intermediate configurations preserve some weaker properties than consistent update, as they are not the new or old policy. However, most of these solutions can only guarantee the packet-level consistency. To achieve the flow-level consistency, Reitblatt, et al., propose dividing rules into pieces and installing the pieces in switches periodically [5]. But a long transition time is required in this method, which may cause severe transmission problems especially if the updating is caused by congestion. Therefore, SDN needs an efficient scheme to guarantee the flow-level consistent update. In this paper, we describe a new scheme for the flow-level consistent update. When a configuration update is invoked, 1) the packets affected by the update are sent to the controller; 2) the controller computes K optimal prefixes covering the existing flows by utilizing the information of these packets; 3) the controller generates some small rules which are composed of the K prefixes and the old rule; 4) these generated rules and the new rule are installed into switches with higher and lower priorities. As ternary Content Addressable Memory (TCAM) is an expensive part in the switch, we divide the update into several rounds to limit rule space overhead. To prevent some rules with big space never disappearing, we also save the rules which space is bigger than the threshold and update them in the next round. To computes K optimal prefixes,

1884

Globecom 2014 - Next Generation Networking Symposium

K-prefix covering algorithm use the IPs of existing flows to constructs a binary tree and get K optimal prefixes (the sum of space is minimal) by dynamic programming. We implement our scheme using POX controller and Mininet [8] platform. • The transition time of our scheme is reduced to 10% of dividing periodically. It shows that our work makes a significant improvement on reducing the configuration update time. • In our scheme, about 1400 flows are redirected to the controller during the update. Although some extra burdens are brought to the controller, using the powerful controller to strengthen the network is reasonable and effective. The remainder of this paper is organised as follows. In section II, we show the background and motivation. In section III, we describe the flow-level consistent mechanism which develops from the two-phase commit. In section IV, we present some definitions, theorems and the K-prefix covering algorithm. In section V, we present the preliminary results of our simulation. In section VI, we review the related work. Finally, we give the conclusion and discussion in section VIII. II. BACKGROUND AND M OTIVATION Computer networks are composed of many different devices such as routers, switches and middleboxes which are implemented by numerous complicated protocols. Simultaneously, operators have to accomplish some complex tasks with limited tools, i.e, translation high-level policies to low-level forwarding rules. As a result, the management of network is quite challenging and error-prone [9]. Another unsurmountable challenge is that networks are extremely difficult to evolve with the huge deployment. These challenges promote the origin of openflow [10] which aims to manage enterprise networks more simply and easily [11]. SDN allows operators to manage networks like a local resource through the abstraction of devices [12]. This is achieved by decoupling the intelligence from the forwarding panel and centralizing it in the control panel. The control panel collects statistics of the network from the forwarding panel, provides the network global view and application interface to operators. The forwarding panel is only responsible for packet forwarding. Operators can implement their custom algorithm on the controller, and then generate rules and control traffic forwarding. Contract to traditional networks, SDN is a centralized control system in the control panel. But in the forwarding panel it is still a distributed system. That means there also exits inconsistent updates which will cause some serious problems like security problem,consistent congestion and connection interruption. So the configuration consistency must be guaranteed during updates. The consistency of configuration update can be divided into packet-level and flow-level consistency [13]. Two-phase commit [5] is used to accomplish the packet-level configuration update. Nonetheless, as the switches are simple and have little intelligence, it is difficult to complete the flow-level update.

One of flow-level mechanisms in SDN is dividing switch rules and waiting for timeouts periodically. The controller refines old rules and installs them in the egress switch with a soft timeout. Obviously this method is very slow. To accelerate the flow-level update,we improve the two-phase commit and forward the packet affected to the controller. Then the controller use K-prefix covering algorithm to get K prefixes and installs them in the egress switch, which can avoid the exploration of the flow table. III. F LOW- LEVEL C ONSISTENT M ECHANISM In openflow network forwarding devices are simple, but the controller is intelligent and powerful. So the basic idea of our mechanism is redirecting the packets affected by the update to the controller and utilizing the controller to accelerate the update. As the flow-level consistency is stronger than packetlevel, we use the two-phase commit to guarantee packet-level consistency and then develop this mechanism to achieve the flow-level consistency update. To prepare update, 1) we divide the network devices and ports into two kinds:the egress switch and the core of network as Figure 1 shows; 2) the egress switch tags the version number to the packets entering the network and the controller adds the version number as a domain of rules; 3) the core network uses the version number to match the packets with the same number; 4) the egress switch also strips the version number when packets leave the network.

Figure 1. Two-phase commit

The steps of our mechanism are as follows. 1) The controller installs new configuration with a new version number in the core network. This operation does not affect the traffic forwarding because there are no packets with the new version number in the network. 2) The controller installs new configuration with a lower priority in the egress switch after the core network completes update. This operation guarantees when a packet comes in, the switch in the core knows how to deal with it. 3) Our mechanism redirects all the flows which affected by the update to the controller when they come in the network during the flow heart break. The flow heart break means the biggest interval between two continuous packets in a flow. If during the flow heart break there are no packets of the flow coming we think the flow expires. During the period, the controller gets the details of existing flows and forwards these flows depending on the old configuration. 4) The controller

1885

Globecom 2014 - Next Generation Networking Symposium

installs small rules for the existing flows and waits a while for the packets traveling between switch and controller. The actions of small rules are the same with the old configuration. 5) The small rules in the switches are timed out and removed. The old configuration disappears with time going and the new configuration takes place. In our flow-level consistent mechanism, all the packets affected by the update are forwarded to the controller. This mechanism shortens the time of the update, but at the same time it also brings some burdens. To optimize, we propose a incremental flow-level consistent mechanism. In this mechanism, if the rule space and the traffic are huge, we divide the rule space into several pieces. In each period, we shift the traffic which matches part of these pieces. Considering the TCAM in switches is an important and expensive resource, We restrict the number of rules we can use during the update. The steps of incremental flow-level consistent mechanism are as follows: 1) choose the pieces to update according to the total rule space and the traffic; 2) start the flow-level consistent mechanism and merges all flows into serval rules (the number equals K minus the number we have used); 3) for the merged rules, save the rule which space is bigger than a threshold and update them in the next period; 4) catch the flow-removed message and change the rules which wait to update. The flowlevel consistent mechanism may install some rules which space is huge and never expires. However, the incremental flow-level consistent mechanism can work around this problem. IV. K- PREFIX COVERING A LGORITHM In this section, we present some simple definitions and theorems. And then we describe the K-prefix covering algorithm employed to merge N IPs and get K prefixes. The controller gets the details of existing flows and then installs exact rules for every flow. To avoid costing too much TCAM the controller must reduce the number of rules. In openflow network there are 12 match fields for an exact rule. But in our algorithm we can use the source or destination IP to represent a flow during the update. Definition 1 (Prefix Space): For a prefix p, space(p) means the number of IPs in p. For a prefix set P S, space(P S) is the sum of space(p) which is the space of prefix p. N (P S) means the number of prefix in P S. For any prefix, we can easily get its prefix space and use the prefix space to evaluate it. If the prefix space is small, it may be timed out fast and removed. But if the prefix space is big, it may be hard to disappear, because before the old flow expires the new one comes in. Definition 2 (Cover ≺): Let p1 and p2 be any prefix and ≺ be a relation of two prefixes, p1 ≺ p2 means ∀p ∈ p1 , p ∈ p2 For prefix set IP S and P S, IP S ≺ P S means ∀pi ∈ IP S, ∃pj ∈ P S, pi ≺ pj As all IPs and prefixes can construct a complete binary tree, p1 ≺ p2 means that p2 is an ancestor node of p1 . For

 two prefixes p2 and p1 , if p2 p1 is not empty the relation between them must be one of p2 ≺ p1 , p1 ≺ p2 and p2 ≡ p1 . Definition 3 (Merge Operation): Let p1 and p2 be any prefix, Merge(p1 ,p2 ) means finding prefix p3 which satisfies p1 ≺ p3 , p2 ≺ p3 and space(p3 ) is minimal. In the binary tree, the merge operation means finding the least common ancestor of two prefixes. For two prefixes, if p1 ≺ p2 the merge operation returns p2 . If there is 3 sorted prefixes p1 p2 and p3 , we can get two new prefixes p12 and p23 by merging the adjacent prefixes. From Definition 2, p12 and p23 cover p2 , so p12 covers p23 or p23 covers p12 . That’s to say, we can use these five prefixes to construct a binary tree. Definition 4 (Min Prefix Space): Let P S and P S  be prefix set, spacek (P S)={Min(space(P S  )), P S ≺ P S  and N (P S  ) = k} It’s obvious that the prefixes in P S  have no common elements. According to Definition 2, if two of these prefixes cover some common elements we can delete one of them and the left prefixes still cover all the IPs. From the left prefixes we can choose one and split it into two prefixes.This operation makes the space smaller. From Definition 3, if two prefixes do not have any common elements they can merge and get a prefix which covers them. For a set which covers N IPs, we sort the IPs and merge the adjacent IPs to get the least common ancestor. The N IPs and N − 1 prefixes can be constructed a binary tree which node has no leaf or two leaves. From this tree, we need to choose K prefixes which have minimal space and covers all the IPs. Theorem 1: For any prefix set P S, spacek (P S)  spacek+1 (P S) From Definition 4, spacek (P S) is the minimal space and all K prefixes have no common elements. We can choose one from K prefixes and split it into two prefixes. Then the space of this new prefixes set is not bigger than spacek (P S) but not smaller than spacek+1 (P S). All flows which affected by the update are forwarded to the controller, and then the controller gets the details (like the source IPs) of these flows. To avoid the explosion of the flow table in the switch, the controller needs to get K prefixes using the source IPs. Our algorithm uses dynamic programming and derives the optimal scheme from bottom to up: 1) sort N IPs and get new N − 1 prefixes through merging the adjacent prefixes; 2) construct a binary tree using N IPs and N −1 merged prefixes; 3) find K nodes from the tree, which space is minimal. Table I defines the set of variables and constants which appear in this K-prefix covering algorithm. In the step 3, we use mergeN ode to compute IS in every node as the Equation 1 shows. In the step 4, we get an allocation scheme P.IS(dlist.start.value.IS) and then get K prefixes from up to bottom. If the scheme allocates m prefixes to a node p, p.IS[m] is the allocation of its children. Additionally, l in p.IS[m] is the number of prefixes allocated to the left child, r is the number of prefixes allocated to the

1886

Globecom 2014 - Next Generation Networking Symposium

Table I VARIABLES AND C ONSTANTS IPs Height K item=< s, l, r > IS={itemi }

the source IPs of flows 32-the mask of prefix the number of prefixes the left child has l prefixes the right one has r prefixes the minimal total space is s an item set

right child and s is the space of this allocation scheme. If l and r in p.IS[m] are 0, it means p is selected and not divided. At the end, we find the best allocation scheme.

⎧ ⎪ ⎨ < min(IS1[j].s + IS2[m].s), j, m >, i = j + m, K ≥ i > 1 IS[i] = ⎪ ⎩ height , i = 1 (1) For example, we have 4 IPs and get 3 prefixes. Then we can construct a binary tree as Figure 2 shows and initialize the leaf nodes 1,2,3,4:height=0,IS = {< 1, 0, 0 >}. IS shows the space of these nodes is one and they have no children. Through merging node 2 and 3, we can get the value of node T :height=2, IS = {< 4, 0, 0 >< 2, 1, 1 >}. The IS of node T means if allocating 1 prefix, it is T ; if allocating 2 prefixes, it is 2 and 3. Height=17

R

S

Algorithm 1 K-prefix covering 1: sort IPs 2: # build a double linked list using IPs 3: initialize dlist 4: for IP in IPs do 5: initialize a node 6: node.value=T reeip with only the root 7: T reeip .height = 0 8: T reeip .pref ix = IP 9: T reeip .IS = < 1, 0, 0 > 10: dlist.add(node) 11: end for 12: for node in dlist do 13: node.height=32-Mask(node,node.next) 14: end for 15: #the bits of IP is 32,the height is less than 33 16: dlist.end.height=33 17: #construct a binary tree 18: flagNode=dlist.start 19: while dlist.start.next!=dlist.end do 20: if flagNode.height < flagNode.next.height then 21: mergeNode(flagNode,flagNode.next) 22: dlist.delete(flagNode.next) 23: flagNode=flagNode.before 24: else 25: flagNode=flagNode.next 26: end if 27: end while 28: IPs merge into one prefix 29: dlist.start.value is the allocation scheme

4

Height=9

1

T

10.1.0.1 Height=2

10.0.0.1 2 10.0.1.1

3 10.0.1.2

Figure 2. Merge example

V. E VALUATION

M ergeN ode merges two prefixes into one and computes IS of the new node. As Equation 1 shows, i is the number of prefixes allocated in this node and IS[i] means the allocation scheme with minimal space among all possible schemes. IS[1] means the number of prefixes allocated is 1 and there is no dividing. So IS[1] equals 2h eight.

In this section, we run our program on two topologies and compare with another algorithm dividing periodically. We implement our algorithm on the popular POX controller and simulate our experiment on Mininet. To evaluate our algorithm, we develop a load-balance application that finds server replicas and then divides traffic between them. The topology is illustrated in Figure 1. The egress switch broadcasts an external IP address using ARP protocol. When receiving the packet which destination IP is the external IP, the egress switch replaces the destination IP with the one of the server replicas’ IP and then forwards the packet. When receiving the packet which source IP is the server’s IP, the egress switch replaces the source IP with the external IP. These actions make the egress switch work like a route and balance the load. The traffic model in our experiment is the Poisson Model which is used most widely. The inter-arrival times are exponentially distributed with the rate parameter 100 and all IPs are evenly distributed across the IP space. To simulate the network changing and the configuration update, one server is provided and another wakes up after a while. The space of source IP is 192.0.0.0/24. At beginning, the egress switch forwards all packets to the live server. After another server wakes up, the controller detects the network change and notifies the load-balance program. Then the program divides the space into pieces and shifts traffic to the new server. In our experiment, we also achieve the method that divides the space and installs the pieces periodically as a comparison. To

1887

Globecom 2014 - Next Generation Networking Symposium

avoid the expansion of the flow table, the number of rules we use during the update is limited. In our experiment it’s 128. We collect the data every 30 seconds.

80 Number of flow

70 60 50 40 30 20 10 0 0

20

30

2 4 3 5 4 3 4 3 6 1 5 5 9 7 5 10 9 9 8 10 7

59 57 68 74 52 75 62 63 69 54 63 65 52 76 78 70 67 55 40 5073 63 Number of 65

55

49

15

49 56 21 Divide periodically-s1 62 56 22 Divide periodically-s2 64 40 30 K prefix with opts-s1 44 54 27 69 49 K prefix with opts-s2 19

54 57 57 52 53 55 34 62 68 50 49 37 60 70 57 43 period 51

48 39 39 37 34 32 32 39

80

90

700

27 28 28 32 20 33 38 39

100

600 Number of flow

57 53 65 69 48 72 58 60 63 53 58 60 43 69 73 60 58 46 10 65 53 58

90

flows is 652 and bigger than other periods which number is about 100. That’s because at first period K-prefix covering monitors all the flows belong to the space and get some pieces which sum is smallest. At left periods, K-prefix covering only monitors and shifts different parts of these pieces.

110

500 400 300 200 100 0 0

1

2

3

Figure 3. Servers’ flow VS period

Figure 3 shows the number of flows through each server at each period. The load balance program uses dividing period and K-prefix covering to balance traffic between servers. The method of dividing periodically takes fifty minutes to complete update. K-prefix covering takes only four minutes. Dividing periodically takes a longer time because it divides the space of prefix and installs all the small pieces in switches periodically regardless of the existing flows. From Figure 4, we can see the change of space more obviously. During update, we shift some traffic from the busy sever to another, that means moving space between servers. Speed of dividing periodically is slower than K-prefix covering, which we can get from the slope. K-prefix covering forwards the flows through controller and then installs the proper small pieces in switch. But dividing periodically treats all the space just the same. 9 Divide periodically K-prefix with opts

8 Space(E+06)

7

4

5

6

7

8

Number of period

Figure 5. Flow through controller VS period

We also evaluate our algorithm on a fat tree topology. The fat tree topology has 20 switches and 16 servers. At first 8 servers work and then another 8 servers wake up. The controller detects this topology change and notifies the loadbalance program. Then load-balance program starts configuration update. The result is shown in Table II, K-prefix covering is faster than dividing periodically. During the update, Kprefix covering adds 795 and deletes 462 rules into the egress switch, while dividing periodically adds 8092 and only deletes 707 rules. That is to say more than 7000 rules in dividing periodically are timed out and deleted automatically.Most of these rules added do not play any role. The controller in Kprefix covering algorithm also needs to forward 1444 flows during the update. In SDN, there may be several hundreds of switches but only several controllers. Using several powerful controllers to strengthen the network’s ability can be accepted.

6

Table II FATTREE RESULT

5 4 3

algorithm

time(min)

2

K-prefix covering with opts dividing periodically

4.5 27.6

1

rules add delete 795 462 8092 707

flows 1444 0

0 0

10

20

30

40

50

60

70

80

90

100 110

VI. R ELATED W ORKS

Number of period

Figure 4. Space VS period

K-prefix covering is more effective than dividing periodically, but it also has some disadvantages. In K-prefix covering, flows in the space which waiting for update must be forwarded to the controller before arriving to the final server. So K-prefix covering costs some extra memory, cpu and bandwidth of the controller. Figure 5 shows the number of flows through the controller in every period. At the first period, the number of

SDN is proposed to facilitate the evolution of network and enable simple management. There are various protocols and mechanisms of avoiding transient undesired states when the planned update happens. Most of them focus on concrete protocol and only a few are about SDN configuration update. The consistent update has been explored in [13]. The authors establish two criteria of consistent update mechanism: packet consistency and flow consistency. Reitblatt [5] provides a network model and the two-phase commit for these two criteria. During the two-phase commit, the egress switch installs

1888

Globecom 2014 - Next Generation Networking Symposium

the new configuration with a new version number after the core of network installs the new configuration with the new version number. After a while, packets with the old version number drain and the old configuration is removed. This mechanism can guarantee per-packet consistency. To achieve flow-level consistency, the author proposes three mechanisms: 1) switch rules with timeouts, 2) wildcard cloning, 3) end-host feedback. As openflow switch is very simple and has little intelligence, only the switch rules with timeouts mechanism can be achieved. During the configuration update, the two-phase commit installs the old configuration and the new one in the network, which costs much TCAM space of switches. An incremental update algorithm [6] which splits the update into several rounds is proposed. In each round: 1) choose a subset of flows which are moved from the old configuration to the new one; 2) find new rules to be installed according to the flows; 3) install rules using the two-phase commit mechanism; 4) find old rules that are not used by any flows and delete them. Multi-commit transactions [14] is proposed to solve the problem which stems from the inconsistent packet processing during network change. This mechanism improves the classic techniques of the database and provides the essential serialization and isolation properties. Vissicchio [15] develops a method to complete anomaly-free update in hybrid networks. The trade-off between the strength of consistency property and dependencies among rules is argued in [16].

[3] [4]

[5]

[6]

[7]

[8]

[9]

VII. C ONCLUSION In this paper, we presented a flow-level consistent mechanism and the K-prefix covering algorithm that satisfy the rule-space constraint. The flow-level incremental consistent mechanism originating from the two-phase commit redirects the flows to the controller. It uses K-prefix covering algorithm to merge the flows’ IPs and get K prefixes in each round to avoid the explosion of the flow table. Then the controller installs the K prefixes in the egress switch. During the update, the flow-level incremental consistent mechanism shifts a part of traffic from the old policy to the new one in each round. The results of our simulation show that our work makes a significant influence on reducing the configuration update time.

[10] [11]

[12]

[13]

VIII. ACKNOWLEDGEMENT This work is supported by the National Research Program of China (973) with No.2012CB315803, the National High-tech R&D Program of China (863) with No.2014ZX03002004 and Shenzhen Key Laboratory of Software Defined Network.

[14]

[15]

R EFERENCES [1] V. Gill, D. McPherson, A. Retana, and D. Walton, “Border gateway protocol (BGP) persistent route oscillation condition,” 2001. Internet Draft. [2] T. G. Griffin and G. Wilfong, “Analysis of the MED oscillation problem in BGP,” in Network Protocols, 2002.

[16]

1889

Proceedings. 10th IEEE International Conference on, IEEE, 2002. N. McKeown, “Software-defined networking,” INFOCOM keynote talk, 2009. R. McGeer, “A safe, efficient update protocol for OpenFlow networks,” in Proceedings of the first ACM SIGCOMM workshop on Hot topics in software defined networks, 2012. M. Reitblatt, N. Foster, J. Rexford, C. Schlesinger, and D. Walker, “Abstractions for network update,” in Proceedings of the ACM SIGCOMM 2012 conference on Applications, technologies, architectures, and protocols for computer communication, 2012. N. P. Katta, J. Rexford, and D. Walker, “Incremental consistent updates,” in Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defined networking, 2013. C.-Y. Hong, S. Kandula, R. Mahajan, M. Zhang, V. Gill, M. Nanduri, and R. Wattenhofer, “Achieving high utilization with software-driven wan,” in Proceedings of the ACM SIGCOMM 2013 conference on SIGCOMM, 2013. B. Lantz, B. Heller, and N. McKeown, “A network in a laptop: rapid prototyping for software-defined networks,” in Proceedings of the ninth ACM SIGCOMM Workshop on Hot Topics in Networks, 2010. D. Oppenheimer, A. Ganapathi, and D. A. Patterson, “Why do internet services fail, and what can be done about it?,” in USENIX Symposium on Internet Technologies and Systems, Seattle, WA, 2003. “The openflow switch specification.” http://OpenFlowSwitch.org. M. Casado, M. J. Freedman, J. Pettit, J. Luo, N. McKeown, and S. Shenker, “Ethane: Taking control of the enterprise,” ACM SIGCOMM Computer Communication Review, 2007. N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenker, “NOX: towards an operating system for networks,” ACM SIGCOMM Computer Communication Review, 2008. M. Reitblatt, N. Foster, J. Rexford, and D. Walker, “Consistent updates for software-defined networks: Change you can believe in!,” in Proceedings of the tenth ACM SIGCOMM Workshop on Hot Topics in Networks, 2011. P. Peresini, M. Kuzniar, N. Vasic, M. Canini, and D. Kostic, “OF. CPP: consistent packet processing for OpenFlow,” tech. rep., Technical report, EPFL, 2013. S. Vissicchio, L. Vanbever, L. Cittadini, G. Xie, and O. Bonaventure, “Safe updates of hybrid SDN networks,” tech. rep., UCL, 2013. R. Mahajan and R. Wattenhofer, “On consistent updates in software defined networks,” in Proceedings of the twelfth ACM SIGCOMM Workshop on Hot Topics in Networks, 2013.