Faucet Conference 2017-10-20123 OCTOBER 2019THE KILLER TAP
WHY YOU SHOULD DEPLOY FAUCET

Faucet Conference 2017-10-202SDN DOESN’T LET HARDWARE
DO ANYTHING IT COULDN’T DO
ALREADYFaucet Conference 2019-10-23
2017-10-203SIMPLIFY YOURNETWORK WITHSDNFaucet Conference 2017-10-204SIMPLIFY YOUR NETWORK WITH SDN"IN ALL EXAMPLES THAT COME TO MIND THE SIMPLE AND
ELEGANT SYSTEMS TEND TO BE EASIER AND FASTER TODESIGN AND GET RIGHT, MORE EFFICIENT IN EXECUTIONAND MUCH MORE RELIABLE THAN THE MORE CONTRIVEDCONTRAPTIONS THAT HAVE TO BE DEBUGGED INTOSOME DEGREE OF ACCEPTABILITY."– E.W. Dijkstra

Faucet Conference 2019-10-23
2017-10-205SIMPLIFY YOUR NETWORK WITH SDN"[…] THE VISION THAT AUTOMATIC COMPUTING SHOULD
NOT BE SUCH A MESS IS OBSCURED, OVER AND OVERAGAIN, BY THE ADVENT OF A MONSTRUM THAT IS
SUBSEQUENTLY FORCED UPON THE COMPUTINGCOMMUNITY AS A DE FACTO STANDARD (COBOL,FORTRAN, ADA, C++, SOFTWARE FOR DESKTOP
PUBLISHING, YOU NAME IT)."– E.W. Dijkstra again, later in the same talkFaucet Conference 2019-10-23
2017-10-20

6

SIMPLIFY YOUR NETWORK WITH SDNSIMPLICITY CAN BE COMPLICATED• Simpler for whom?
• To do what?
• What are the trade offs?
Simplicity needs to be in aid of a simple goal

Faucet Conference 2019-10-23
2017-10-20

7

SIMPLIFY YOUR NETWORK WITH SDN

NETWORKING IS SIMPLE• Take packets from a port
• Send them to another• (Mostly)

Faucet Conference 2019-10-23
2017-10-20

8

SIMPLIFY YOUR NETWORK WITH SDN

COORDINATION IS COMPLEX• SDN adds a level of coordination between the controller anddatapath• But! It greatly reduces the coordination between datapaths• Coordination isn’t just between devices, its between protocols
within a device.
•Maybe we have a chance to turn some of those off?

Faucet Conference 2019-10-23
2017-10-20

9SIMPLIFY YOUR NETWORK WITH SDN

NETWORKING IN ONE EQUATION= availability * security / (effort * cost)

Faucet Conference 2019-10-23
2017-10-20

10SIMPLIFY YOUR NETWORK WITH SDN(OR MORE FORMALLY)
𝑃 𝑎" < 𝑢"!
(𝑐" . 𝑒" . 𝑡" )"∈𝔽

𝔽 𝑖𝑠 𝑡ℎ𝑒 𝑠𝑒𝑡 𝑜𝑓 𝑟𝑒𝑞𝑢𝑖𝑟𝑒𝑑 𝑓𝑒𝑎𝑡𝑢𝑟𝑒𝑠
𝑎7 𝑖𝑠 𝑡ℎ𝑒 𝑟𝑒𝑞𝑢𝑖𝑟𝑒𝑑 𝑎𝑣𝑎𝑖𝑙𝑎𝑏𝑖𝑙𝑖𝑡𝑦 𝑜𝑓 𝑓𝑒𝑎𝑡𝑢𝑟𝑒 𝑥
𝑢7 𝑖𝑠 𝑡ℎ𝑒 𝑜𝑏𝑠𝑒𝑟𝑣𝑒𝑑 𝑢𝑝𝑡𝑖𝑚𝑒 𝑜𝑓 𝑓𝑒𝑎𝑡𝑢𝑟𝑒 𝑥
𝑐7 𝑖𝑠 𝑡ℎ𝑒 𝑐𝑜𝑠𝑡 𝑜𝑓 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑓𝑒𝑎𝑡𝑢𝑟𝑒 𝑥
𝑒7 𝑖𝑠 𝑡ℎ𝑒 𝑒𝑓𝑓𝑜𝑟𝑡 𝑜𝑓 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑓𝑒𝑎𝑡𝑢𝑟𝑒 𝑥
𝑡7 𝑖𝑠 𝑡ℎ𝑒 𝑡𝑖𝑚𝑒 𝑟𝑒𝑞𝑢𝑖𝑟𝑒𝑑 𝑡𝑜 𝑜𝑝𝑒𝑟𝑎𝑡𝑒 𝑓𝑒𝑎𝑡𝑢𝑟𝑒 𝑥
Faucet Conference 2019-10-23
2017-10-20

11

SIMPLIFY YOUR NETWORK WITH SDN

NETWORKING IN ONE EQUATION= availability * security / (effort * cost)

Faucet Conference 2019-10-23
2017-10-20

12

SIMPLIFY YOUR NETWORK WITH SDNREDUCING EFFORT• Software doesn’t write itself• SDN needs a long term commitment

Faucet Conference 2019-10-232017-10-2013LEARN TO LOVEYOUR FLOW TABLE

Faucet Conference 2017-10-2014

THE FLOW TABLE IS A ONE STOPSHOP FOR ALL YOUR NETWORKDEBUGGING NEEDS

Faucet Conference 2019-10-23
2017-10-2015

LEARN TO LOVE YOUR FLOW TABLE(ALMOST)• MTU?
• What does happen to fragments in an Open Flow network?
• Maybe the Flow Table is wrong?

Faucet Conference 2019-10-23
2017-10-20

16LEARN TO LOVE YOUR FLOW TABLE

FLOW TABLES ARE INTIMIDATING

Faucet Conference 2019-10-23
2017-10-2017

LEARN TO LOVE YOUR FLOW TABLE

BUT THEY ARE VERY SWEET WHEN YOU GET TO KNOWTHEM• At least the nicely formatted ones you get directly from yourswitch usually are• Priority, Matches and Actions•

Hard to simplify things further without losing information• Remember to subtract 4096 from your vlan vids
• Just follow your packet through the table

Faucet Conference 2019-10-23
2017-10-20

18

LEARN TO LOVE YOUR FLOW TABLEGAUGE FLOW TABLE MONITORING• Not particularly nicely formatted (for people)• But it does save you logging into every device on the network

Faucet Conference 2019-10-23
2017-10-20

19

LEARN TO LOVE YOUR FLOW TABLEGAUGE FLOW TABLE MONITORING• And Software fixes everything!

Faucet Conference 2019-10-23
2017-10-2020

LEARN TO LOVE YOUR FLOW TABLEQUERYABLE
Why aren’t my LACP packets getting forwarded???

Faucet Conference 2019-10-23
2017-10-20

21

LEARN TO LOVE YOUR FLOW TABLEQUERYABLE
Three possibilities:•••

That rule shouldn’t be there!
Some other rule is missing!
Oh! I’m an idiot!

But this requires the ability to know why any given rule in theflow table is there

Faucet Conference 2019-10-23
2017-10-20

22

LEARN TO LOVE YOUR FLOW TABLETHE FLOW TABLE IS A POWERFUL TOOL
• The more complex we make it, the higher we raise the bar forpeople to take advantage of it• Documentation and tooling helps• But ultimately the simpler it is, the easier it will be

Faucet Conference 2019-10-23
2017-10-2023

MORE FLOW TABLE
FUN

Saberwyn [CC BY-SA 4.0(https://creativecommons.org/licenses/by-sa/4.0)]
Faucet Conference 2017-10-2024

MORE FLOW TABLE FUNTESTABLE• Write a test that verifies that your network will never forward
LACP

Faucet Conference 2019-10-23
2017-10-2025

MORE FLOW TABLE FUNFLOW TABLES AREN’T THAT BIG• You can run this in reverse too• Find all possible packets that could output a packet to port 1• If port 1 has reasonably tight access control, this would not
be too onerous

Faucet Conference 2019-10-23
2017-10-20

26

MORE FLOW TABLE FUN

SUPER-CYBER-RFP• You could automatically build test packets to do a complete
search of all possible rule combinations from a given flowtable
• 100% flow table test coverage

Faucet Conference 2019-10-23
2017-10-20

27

MORE FLOW TABLE FUN

WHAT IF IT ISN’T THE FLOW TABLE• The device is doing something I think the flow table says itshouldn’t• Try loading the flow table onto Open vSwitch, is the behaviorconsistent?
•Am I being an idiot?

• Try loading the flow table onto another of the same device, isthe behavior consistent?
•Is it a hardware fault or a software fault?

Faucet Conference 2019-10-23
2017-10-2028

Faucet Conference 2017-10-2029