Software-defined networking
Traditional routers bundle forwarding hardware with their own control software. Software-defined networking separates the two, making networks programmable from logically centralised controllers.
Data plane and control plane
The data plane forwards packets using tables, at line rate in hardware. The control plane decides what goes in those tables, using routing protocols and configuration. In traditional networks, each router runs its own control plane in vendor software, so changing network behaviour means configuring many boxes, often with vendor-specific commands.
The SDN idea
Software-defined networking (SDN) separates the control plane from the data plane. Simple switches forward packets according to match-action rules installed by a logically centralised controller, which has a network-wide view and exposes interfaces to applications for routing, load balancing, access control, and more. Behaviour changes by updating software, not reconfiguring each device.
OpenFlow and match-action
OpenFlow, developed at Stanford around 2008, was the first widely known SDN protocol between controllers and switches. A flow table entry matches header fields, such as input port, MAC addresses, VLAN, IP addresses, and ports, and specifies actions: forward to a port, drop, modify headers, or send to the controller. Counters record matched packets and bytes.
Generalised forwarding
Match-action unifies many devices: a router matches destination prefixes and forwards; a firewall matches addresses and ports and drops; a NAT matches and rewrites addresses; a load balancer matches and spreads flows. Programmable data planes take this further: the P4 language lets operators define how switches parse headers and which match-action tables they have, on programmable switching chips.
SDN in practice
Google's B4 network, described in 2013, used SDN to manage traffic between its data centres, running links at near full utilisation by centrally allocating bandwidth by priority. Cloud providers use SDN extensively for virtual networks, letting customers create isolated networks, subnets, and firewalls in software. Software-defined WAN (SD-WAN) products apply similar ideas to connect branch offices over multiple internet links.
Network virtualisation and NFV
Network virtualisation creates many logical networks over one physical network, using overlays such as VXLAN, which carries Ethernet frames inside UDP packets so virtual machines in different racks can share a virtual layer-2 network. Network functions virtualisation (NFV) runs functions such as firewalls, load balancers, and mobile core components as software on standard servers instead of dedicated hardware boxes.
Challenges
A centralised controller is a potential single point of failure and a high-value target, so controllers are replicated using consensus protocols. Controller-switch communication must be secured, rule updates must be consistent so packets never see half-updated paths, and large networks need hierarchical or distributed controllers. Many real deployments combine SDN with traditional distributed protocols.
Worked example
A controller manages a small campus network. A security application detects a compromised laptop at a known MAC address. Instead of logging into several switches, it calls the controller's API; the controller installs a high-priority rule on the access switch, match source MAC 3c:22:fb:1a:4e:07, action drop, and a rule on the core switches redirecting that host's web traffic to a quarantine page. The change takes effect network-wide in under a second.
Key takeaways
The data plane forwards packets; the control plane computes forwarding state. SDN separates them, with a logically centralised controller programming simple switches through match-action rules. OpenFlow (about 2008) defined matches on header fields and actions such as forward, drop, modify, or send to the controller. Generalised forwarding unifies routers, firewalls, NAT, and load balancers; P4 programs data planes. Google's B4 (2013), cloud virtual networks, and SD-WAN show SDN in practice. VXLAN overlays virtualise networks; NFV runs network functions as software. Controllers must be replicated and secured, and updates kept consistent.
Flashcard
Forwards packets using tables
Check your understanding
In SDN, what is the main role of the controller?