Checking the OpenFlow Rule Installation and Operational Verification

Troubleshooting in SDN-based networks tends to be a cumbersome task that might overwhelm human attention. Researchers have uncovered various misconfiguration errors such as faulty rules and anomalous forwarding logic caused by missing batch-update acknowledgements and faulty protocol implementations. In this paper, we address the issue of inspecting entries in SDN flow tables by actively probing the data plane. iRecent works such as Monocle and Pronto address this by inserting a test rule per OpenFlow entry. However, this leads to an excessive increase in the size of the OpenFlow tables and unfortunately a wastage of the already scarce TCAM memory and an increase in the packet matching time. We present an efficient testing approach that uses a minimal number of test rules, as large as the number of the neighboring switches which is a handful number compared to Monocle and Pronto where the number of test of rules can be in the order of thousands depending on the size of the OpenFlow table. Furthermore, we devise an efficient and fast probe generation algorithm that generates one single probe packet per rule. Our experiment demonstrates that it takes approximately 1 second to test 3000 rules.