A method by one or more network devices implementing a first controller in a software defined networking, SDN, network for programming a switch in the SDN network to use a controller port as a watch port, the method comprising: generating an instruction for the switch to create a first group entry for a first group in a packet processing pipeline of the switch, wherein the first group entry includes a first bucket that specifies a first controller port as a watch port and an action for the switch to forward packets to the first controller via the first controller port, wherein the first controller port is a port that is associated with a control channel between the switch and the first controller, wherein the first controller port being specified as the watch port in the first bucket indicates that execution of the action specified by the first bucket is to be contingent upon a liveness of the first controller port; and sending the instruction to the switch to cause the switch to create the first group entry in a packet processing pipeline of the switch, wherein the first group entry further includes a second bucket that specifies the first controller port as a watch port and an action for the switch to forward packets via a specified port, wherein the first controller port being specified as the watch port in the second bucket indicates that execution of the action specified by the second bucket is to be contingent upon the liveness of the first controller port, wherein the first group is of a replication group type, wherein the replication group type is a type of group for which all buckets in the group are to be executed, and wherein the replication group is used by the switch to send a copy of traffic to the first controller and wherein the first group is used by the switch to process packets that are to be analyzed by the first controller for security threats. generating an instruction for the switch to create a first group entry for a first group in a packet processing pipeline of the switch, wherein the first group entry includes a first bucket that specifies a first controller port as a watch port and an action for the switch to forward packets to the first controller via the first controller port, wherein the first controller port is a port that is associated with a control channel between the switch and the first controller, wherein the first controller port being specified as the watch port in the first bucket indicates that execution of the action specified by the first bucket is to be contingent upon a liveness of the first controller port; and sending the instruction to the switch to cause the switch to create the first group entry in a packet processing pipeline of the switch, wherein the first group entry further includes a second bucket that specifies the first controller port as a watch port and an action for the switch to forward packets via a specified port, wherein the first controller port being specified as the watch port in the second bucket indicates that execution of the action specified by the second bucket is to be contingent upon the liveness of the first controller port, wherein the first group is of a replication group type, wherein the replication group type is a type of group for which all buckets in the group are to be executed, and wherein the replication group is used by the switch to send a copy of traffic to the first controller and wherein the first group is used by the switch to process packets that are to be analyzed by the first controller for security threats.