In an SDN controller, when a new packet arrived to an OpenFlow-based router or switch and does not find a match flow entry in the OpenFlow flow tables, what does the SDN controller do? Does it just forward that packet to the destination and install its corresponding flow entry in the flow table? If so, why not just drop it for security reasons?

2 Answers 2


When a packet is received at an SDN switch that doesn't have a rule associated with it, it gets forwarded to the controller. Now, the controller may choose to drop it, or do something special (like log it and then forward). This behavior is key to implementing many Openflow features, like learning switches.


  • 1
    This is not necessarily true - it is an option in OpenFlow, but it doesn't scale, and is thus not generally used in production. Previously unclassified packet matches are dropped by default. Jan 4, 2016 at 12:35

The Controller doesn't do anything right away - it does not know this event has occurred. The initial decision to be made has to be made by the device that received the packet it can't match. It may decide (due to configuration) to send that packet to the Controller, but simple math indicates that this doesn't scale (the management interface is very slow compared to the aggregate front-panel throughput of the device) and so by default unmatched packets are dropped.

If the device sends the packet to the Controller (or, more likely, just the first hundred bytes or so) then of course the Controller is free to do anything it likes with this data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.