A flow table processing method, wherein the method is applied to a software-defined network, SDN, the SDN comprises a controller and multiple switches, and the method comprises: determining, by the controller according to a network topology, a second switch directly connected to a first switch, wherein the first switch is any switch of the multiple switches, the second switch is a switch other than the first switch in the multiple switches, and there is at least one second switch; obtaining, by the controller, a flow table load of the second switch; determining, by the controller, a diffusion flow table of the first switch according to the flow table load of the second switch; and sending, by the controller, the diffusion flow table to the first switch; the diffusion flow table is used by the first switch to determine, when the flow table load of the first switch exceeds a preset threshold, a diffusion target of a target data flow according to a matching rule of the diffusion flow table, wherein the target data flow is a data flow that fails to be matched to a flow table of the first switch; wherein the determining, by the controller, the diffusion flow table of the first switch according to the flow table load of the second switch comprises: determining, by the controller, a forwarding path of the first switch according to a connection relationship between the first switch and the second switch, wherein the forwarding path is a path between the first switch and the second switch; determining, by the controller, a diffusion probability of each forwarding path according to a flow table load of the second switch on each forwarding path; and determining, by the controller according to the diffusion probability of each forwarding path, a quantity of egress ports of the first switch corresponding to each forwarding path, wherein the egress ports of the first switch are configured to forward data flows; and determining, by the controller, the diffusion flow table of the first switch according to each forwarding path and the quantity of egress ports of the first switch corresponding to each forwarding path. determining, by the controller according to a network topology, a second switch directly connected to a first switch, wherein the first switch is any switch of the multiple switches, the second switch is a switch other than the first switch in the multiple switches, and there is at least one second switch; obtaining, by the controller, a flow table load of the second switch; determining, by the controller, a diffusion flow table of the first switch according to the flow table load of the second switch; and sending, by the controller, the diffusion flow table to the first switch; the diffusion flow table is used by the first switch to determine, when the flow table load of the first switch exceeds a preset threshold, a diffusion target of a target data flow according to a matching rule of the diffusion flow table, wherein the target data flow is a data flow that fails to be matched to a flow table of the first switch; wherein the determining, by the controller, the diffusion flow table of the first switch according to the flow table load of the second switch comprises: determining, by the controller, a forwarding path of the first switch according to a connection relationship between the first switch and the second switch, wherein the forwarding path is a path between the first switch and the second switch; determining, by the controller, a diffusion probability of each forwarding path according to a flow table load of the second switch on each forwarding path; and determining, by the controller according to the diffusion probability of each forwarding path, a quantity of egress ports of the first switch corresponding to each forwarding path, wherein the egress ports of the first switch are configured to forward data flows; and determining, by the controller, the diffusion flow table of the first switch according to each forwarding path and the quantity of egress ports of the first switch corresponding to each forwarding path. determining, by the controller, a forwarding path of the first switch according to a connection relationship between the first switch and the second switch, wherein the forwarding path is a path between the first switch and the second switch; determining, by the controller, a diffusion probability of each forwarding path according to a flow table load of the second switch on each forwarding path; and determining, by the controller according to the diffusion probability of each forwarding path, a quantity of egress ports of the first switch corresponding to each forwarding path, wherein the egress ports of the first switch are configured to forward data flows; and determining, by the controller, the diffusion flow table of the first switch according to each forwarding path and the quantity of egress ports of the first switch corresponding to each forwarding path.