Detection of Flow Violation in Distributed SDN Controller

Software Defined Network (SDN) paradigm has revolutionized the way enterprise networks are designed by separating the control and data plane. It introduces a programmable network architecture which enables rapid and open innovation in different network functions that are allowed to install flow rules in forwarding elements via protocols like OpenFlow. Packet processing also becomes easier due to availability of packet information across different layers. But all these benefits may turn into great challenges because of the use of some features in OpenFlow. One of them, the setfield feature is widely used by network functions like firewall, router, load balancer etc. to modify packet header while in transit. Like distributed firewall setup, where rule in one firewall may conflict with that of other, in SDN, if multiple controller is used for individual networks or subnetwork within an organization, then change in flow rule in one controller may conflict with flow rules in other controller. Un-monitored management of flow may cause packets to loop through switches in single or multiple network, adversely affecting the network performance. In this paper, we introduce a mechanism using a directed graph representation to detect forwarding rules that cause forwarding loop, direct or indirect flow violation in a distributed controller environment. This helps network administrators to avoid possible security breaches, network congestion or even complete network failure caused by misconfiguration in security policies in different subnetworks.