###### Abstract
The level of data transfer, represented by software or hardware-software switches, performs the functions of L2 and L3 level switches for processing and transmitting network traffic. Each switch receives a set of rules via the control channel and OpenFlow control protocol from the controller. In turn, the OpenFlow control protocol provides the controller with the ability to use special routing tables and/or modify packets transmitted to switches. The rules transmitted using the OpenFlow protocol can be both group and discrete for each flow separately. Packets arriving at the switch's input buffer are first checked to see if their headers match the rule templates in the null table. Packet headers are compared with rule templates in descending order of rule priority, and if the header matches the template, then the instruction associated with the selected rule is executed. Such instructions can be: sending a packet to a certain port, dropping the packet or sending the packet to the controller for further analysis. Three main components can be distinguished in SDN (Figure 1): controller; control channel (OpenFlow); outer. As with the classical architecture, the main elements are routers/switches that process L2/L3 network traffic. However, in this case, network devices are entrusted with the function of forwarding traffic between end users, and all decisions related to filtering and route rebuilding, which in the classical implementation of the network are performed by dynamic routing protocols, in this case, are fulfilled by the controller. The controller, in turn, has two interfaces: the OpenFlow server, which directly manages the network and checks the status of ports/devices using the OF-CONFIG protocol, and an API provided to network applications. Understanding of functioning processes is determined by two levels of SDN technology (Table 1):  
* Control level (control plane);
* Data transfer level (data plane). Communication between the levels is carried out by the Open Flow control protocol. An appropriate secure channel is implemented for the operation of the control protocol. It can be either a separate physical controller-switch connection or a logical channel passing through other SDN devices. Information is exchanged over the control channel. Control commands from the controller to the switch and information about the status of logical switches and the communication channel between devices are transmitted from the switch to the controller. One of the main advantages of this solution is centralized management. Such centralization allows one to dynamically change the routes of traffic transmission in the network based on changing conditions. When one is creating new routes and connecting new channels, the controller responsible for a particular segment sends the necessary rules to each device. This distinguishes SDN from the classical approach, in which, when there are changes in the network structure, the administrator is forced to prescribe the necessary rules element by element manually or using the SSH/TELNET control protocols [3]. However, such as many new solutions, SDN has a number of drawbacks [4; 5]:  
* A software solution entails thousands of lines of program code, which, in turn, entails the presence of unintentional errors;
* A significant part of the vulnerabilities was pumped into the technology from the TCP/IP protocol stack;
* The presence of a device that fully manages the network and owns all the information about the network requires additional protection means and mechanisms;
* A new technology implies an intensive emergence of new vulnerabilities specific to this technology. Figure 1: Structural diagram of a software-defined network.