Characterizing Rule Compression Mechanisms in Software-Defined Networks

Software-defined networking (SDN) separates the network policy specification from its configuration and gives applications control over the forwarding rules that route traffic. On large networks that host several applications, the number of rules that network switches must handle can easily exceed tens of thousands. Most switches cannot handle rules of this volume because the complex rule matching in SDN (e.g., wildcards, diverse match fields) requires switches to store rules on TCAM, which is expensive and limited in size. We perform a measurement study using two real-world network traffic traces to understand the effectiveness and side-effects of manual and automatic rule compression techniques. Our results show that not using any rule management mechanism is likely to result in a rule set that does not fit on current OpenFlow switches. Using rule expiration timeouts reduces the configuration footprint on a switch without affecting rule semantics but at the expense of up to 40% increase in control channel overhead. Other manual (e.g., wildcards, limiting match fields) or automatic (e.g., combining similar rules) mechanisms introduce negligible overhead but change the original configuration and may misdirect less than 1% of the flows. Our work uncovers trade-offs critical to both operators and programmers writing network policies that must satisfy both infrastructure and application constraints.