A method of using a controller that controls switches (SW1, SW2, SW3) in a network having end hosts (EH1, EH2, EH3) that are coupled to the switches, the method comprising: at the controller, receiving a given network policy rule, using the controller, generating flow table entries for the switches (SW1, SW2, SW3) coupled to the end hosts (EH1, EH2, EH3) based on the network policy rule; using the controller, forming virtual switches (VSW1, VSW2, VSW3) coupled to groups of the end hosts (EH1, EH2, EH3) from the switches (SW1, SW2, SW3), and applying the network policy rule at the virtual switches (VSW1, VSW2, VSW3), wherein the network policy rule is implemented using flow table entries generated by the controller for the virtual switches (VSW1, VSW2, VSW3), wherein the virtual switches (VSW1, VSW2, VSW3) coupled to the groups of the end hosts (EH1, EH2, EH3) form a logical network topology in the network, and wherein the switches (SW1, SW2, SW3) coupled to the end hosts (EH1, EH2, EH3) form a physical network topology in the network underlying the logical network topology in the network; and using the controller, performing a test in determining whether the network satisfies the given network policy rule, wherein performing the test comprises: generating a test packet (202, 206, 210, 214); identifying any network policy rules that are triggered by a packet traversal of the logical network topology using the test packet (202, 206, 210, 214); and determining whether the given network policy rule matches any of the triggered network policy rules to identify whether the given network policy rule is invalid. at the controller, receiving a given network policy rule, using the controller, generating flow table entries for the switches (SW1, SW2, SW3) coupled to the end hosts (EH1, EH2, EH3) based on the network policy rule; using the controller, forming virtual switches (VSW1, VSW2, VSW3) coupled to groups of the end hosts (EH1, EH2, EH3) from the switches (SW1, SW2, SW3), and applying the network policy rule at the virtual switches (VSW1, VSW2, VSW3), wherein the network policy rule is implemented using flow table entries generated by the controller for the virtual switches (VSW1, VSW2, VSW3), wherein the virtual switches (VSW1, VSW2, VSW3) coupled to the groups of the end hosts (EH1, EH2, EH3) form a logical network topology in the network, and wherein the switches (SW1, SW2, SW3) coupled to the end hosts (EH1, EH2, EH3) form a physical network topology in the network underlying the logical network topology in the network; and using the controller, performing a test in determining whether the network satisfies the given network policy rule, wherein performing the test comprises: generating a test packet (202, 206, 210, 214); identifying any network policy rules that are triggered by a packet traversal of the logical network topology using the test packet (202, 206, 210, 214); and determining whether the given network policy rule matches any of the triggered network policy rules to identify whether the given network policy rule is invalid. generating a test packet (202, 206, 210, 214); identifying any network policy rules that are triggered by a packet traversal of the logical network topology using the test packet (202, 206, 210, 214); and determining whether the given network policy rule matches any of the triggered network policy rules to identify whether the given network policy rule is invalid.