Real time network policy checking using header space analysis

TLDR

Rapid network changes driven by customer demands, load, or configuration require continuous correctness checks such as tenant isolation, yet existing policy checkers are too slow because they must gather and analyze state from the entire network. This work presents NetPlumber, a real‑time policy‑checking tool built on Header Space Analysis. NetPlumber incrementally verifies compliance by maintaining a dependency graph of rules, making it suitable for both SDN and conventional networks. Evaluation on Google SDN, the Stanford backbone, and Internet 2 shows that checking a typical rule update against a single policy takes only 50–500 µs on average.

Abstract

Network may change rapidly in response to customer demands, load conditions or configuration changes. But the network must also ensure correctness conditions such as isolating tenants from each other and from critical services. Existing policy checkers cannot verify compliance in real time because of the need to collect state from the entire network and the time it takes to analyze this state. SDNs provide an opportunity in this respect as they provide a logically centralized view from which every proposed change can be checked for compliance with policy. But there remains the need for a fast compliance checker. Our paper introduces a real time policy checking tool called NetPlumber based on Header Space Analysis (HSA) [8]. Unlike HSA, however, NetPlumber incrementally checks for compliance of changes, using a novel set of conceptual tools that maintain a dependency graph between rules. While NetPlumber is a natural fit for SDNs, its abstract intermediate form is conceptually applicable to conventional networks as well. We have tested NetPlumber on Google's SDN, the Stanford backbone and Internet 2. With NetPlumber, checking the compliance of a typical rule update against a single policy on these networks takes 50-500µs on average.