Real Time Network Policy Checking Using Header Space Analysis
summary
NetPlumber implements Header Space Analysis as an incremental checker that builds a dependency graph of individual forwarding rules and updates only the affected subgraph on each rule or link change. It verifies path- and header-based invariants (reachability, middlebox traversal, loop and black‑hole detection) against 143k OpenFlow rules on Google VAN, running ~60% of rule updates <1 ms and ~95% <10 ms, with link changes taking seconds and parallelism limited to about five clusters.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:30Network debugging is hard!
- 2:01Header Space Analysis: Snapshot-based Checking
- 2:39Steam-based Checking
- 3:46Outline
- 6:06NetPlumber - Nodes and Edges
- 8:20NetPlumber - Computing Reachability
- 12:26Checking Policy with NetPlumber
- 14:48Why the dependency graph helps
- 15:32Dependency Graph Clustering
- 15:59Experiment On Google WAN
- 19:19Conclusions
related talks
20mContra: A Programmable System for Performance aware Routing
20mPlankton: Scalable network configuration verification through model checking
25mDataplane equivalence and its applications
24mAutomatically Correcting Networks with NEAt
18mAPKeep: Realtime Verification for Real Networks
29mFinding the Needle in a Haystack: Tenant-Level Network...
24mLocality-Aware, Self-Adjusting Data Structures: A Case Study in Linux Firewalls
17mDifferential Network Analysis