Hot answers tagged

11

Open vSwitch has a section on that in their FAQ: Q: Why would I use Open vSwitch instead of the Linux bridge? A: Open vSwitch is specially designed to make it easier to manage VM network configuration and monitor state spread across many physical hosts in dynamic virtualized environments. Refer to Why Open vSwitch? for a more detailed description of ...


10

Disclaimer: I work at Cumulus Networks To address a few of the high level points/concerns raised: 1.) Is ONIE getting traction? ONIE is the de facto method for getting software onto whitebox switches. It's been embraced by Dell, HP, Supermicro, Penguin, Facebook and a few others. It's run out of the Open Compute Project (http://www.opencompute.org/) an ...


8

As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does tend to "cripple" their functionality in many ways. The new trend in security of this type is Network Traffic Analysis (NTA). Just as many companies are far less ...


6

is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk? There is the potential for both risks and rewards with choosing such a solution. Will the company disappear leaving the product abandoned? Possibly. Are there greater chances of bugs/problems with the code that aren't resolved in a timely ...


6

No routing protocol is used. The purpose of routing protocols is to tell other routers which paths are available, so the other routers can make a good forwarding decision. In SDN, the controller has a complete view of the network -- it already knows all the paths. The controller calculates the best path for a particular kind of data, and then uses a ...


6

I disagree with the answer provided @Pedro Perez, I think his answer is mixing phrases and ambiguous so I have provided my own interpretation below. SDN: I think it is pretty much what the name says “Software Defined Networking”. This means to me that software is defining the paths that packets take across the network automatically (possibly with some upper ...


6

We've always said that SDN Controllers are "Protocol-less", they don't need to know the packet's encoding to switch it. Or, controllers can route packets by the IP Address. And the IP Address used to be encoded on the header of the packet You misunderstand the idea of "protocol-less." It means the controller doesn't run a routing protocol, since it ...


5

Short version: it doesn't. Longer version: Openflow is just a protocol for communicating between the 'forwarding units' and a controller. It is the controller itself that determines what to do with packets, and it can do this in any way it likes. You can implement most of the current routing protocols in an OpenFlow controller, see for instance RouteFlow. ...


5

I am assuming you are talking about Software Defined Networking. Currently state of the art networks make forwarding decisions within your networking infrastructure. Example - bridge tables are built dynamically from source MAC packets - routing decisions are made off of route tables built from dynamic routing protocol (eigrp/ospf/etc.). In SDN the network ...


5

Software Defined networks do not have a device explicitly named as router. The Network is generally made of switches and controllers. However, can sdn networks achieve functionality of routing ? Definitely! Sdn uses controllers. In a very broad sense controllers work on the principle of match criteria and corresponding action . The controller uses the ...


5

SDN is anything but a standard. So it is possible that some SDN implementations allow to inject / delete routes while other don't. BGP is one routing protocol among many. A router learn routes from directly connected networks, static routes and routing protocols. A SDN controller should at least able to add or remove static routes. A SDN BGP feature could ...


5

Using QinQ (802.1ad) double tagging, you can use an inner (customer) VLAN ID and an outer (provider) VLAN ID. The point is that a provider can provide full, 802.1Q-tagged services to each client and still use the outer tag for their own VLAN infrastructure. Double tags can be used in plain frames or inside a (VPN) tunnel.


5

One of the points of SDN is that you build a virtual "network box" where all your switching, routing, NATing, etc happens and that looks like a single device from the outside, regardless of its physical components and their locations. Obviously, that's detrimental to tools like traceroute that depend on distinct L3 hops they can trace. Usually, a SDN ...


4

Openflow is to SDN as OSPF is to Routing


4

When a packet is received at an SDN switch that doesn't have a rule associated with it, it gets forwarded to the controller. Now, the controller may choose to drop it, or do something special (like log it and then forward). This behavior is key to implementing many Openflow features, like learning switches. https://github.com/mininet/openflow-tutorial/wiki/...


4

is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk? This is always an issue. Products from a small vendor could (and more often than not, do) end up abandoned. As long as they continue to function, there's little to worry about. But when they break, there's nowhere to go but somewhere else. ...


4

Yes, the openflow protocol supports the creation of flows with multiple actions, and each action can be to send a frame/packet out a certain port. However, whether or not your openflow switch supports this is a different matter. E.g. this Cisco doc states that only "output to a single port" is supported by version 1.1.5 of their Openflow agent on Nexus ...


4

For the actual payload inspection you need to break the encryption. That is the only way to detect drive-by malware downloads and similar threats. The usual way that works is the same way as a man-in-the-middle attack: the server-side encryption is terminated at the inspecting firewall, the firewall re-encrypts the client-side connection and passes data in ...


3

XR probably wants NETCONF 1.1. If you enable debugging you might find something like this in your log: RP/0/RSP0/CPU0:Sep 8 09:47:27.513 : netconf[1120]: ERR: NC: Error, Capability urn:ietf:params:netconf:base:1.1 not found RP/0/RSP0/CPU0:Sep 8 09:47:27.513 : netconf[1120]: ERR: NC: Hello message validation failed RP/0/RSP0/CPU0:Sep 8 09:47:27.514 : ...


3

Having an out-of-path router inject a route into another BGP speaker is quite common - consider the way a route-reflector works - they are often BGP daemons running on servers with no transit traffic. In fact an RR is probably a good analogy for an SDN controller - it receives all paths, computes the best from it's point of view, then advertises this to all ...


3

Let's forget about SDN for the moment, and consider what happens in a traditional router. There is some software that looks at the BGP configuration and also the BGP information from peers, and reaches some conclusion about what prefixes must be forwarded to what interface. Now the same router may also have other routing protocols running simultaneously, and ...


3

SDN is still being developed, so there are no hard and fast rules. But generally speaking, the controller has a complete view of the network, so there is no need for a routing protocol. However, there is still the problem of how the switches forward control plane traffic to the controller. Some solutions have the switches run a routing protocol so they ...


3

Without knowing which SDN you're referring to, and without knowing what material you're reading, I think we're just going to be guessing. With that said, not all SDN solutions have separate data and control planes. I think it's common for a single transport network to handle control and data traffic. I think a more likely explanation for the term ...


3

I think it’s mostly a cost and scaling issue. When operating in the scale those big networks operate, you don’t care about a single server losing connectivity, you think in scale of data centers going offline. Why invest in more switch ports to increase availability of one single server when you can load balance that traffic over tens of thousands of ...


3

An SDN controller generally doesn't forward user data (at least not with OpenFlow). It often only gets a digest from an unmatched packet (the essential data extracted), so there might even be nothing to forward.


3

Welcome to NE! We hope you will become a contributing member of this community. The terms you mention, like a lot of networking terms, are often defined by the system manufacturers, and they are free to have them mean whatever they want in order to sell their products. In other words, the definitions are not precise and can change over time. Different ...


3

In the manual you've linked, check page 206: channel-group The group of channel-group commands allows configuring Etherchannel/port bundling. After port is assigned to channel-group, all configuration for this port is cleared, e.g.: it is removed from participation in any Vlans, and static MAC definitions are removed. LAG configuration is applied for ...


3

Although they are both related to quality of service, they are completely different concepts. IEEE 802.1p is a mechanism (format) for marking "class of service" (CoS) on Ethernet frames. The CoS has eight values (0-7) and is used to signal the relative priority of the frame. The standard recommends some meaning to the different values (higher is better), ...


3

Something has to set the DSCP values. In a traditional network, that comes from either the end user / application, or intervening network hardware. Unless you have significant control of the device/application -- eg. VoIP phone -- the former can be a very dangerous road. The later is a very complicated, and tedious process. It is this area that machine ...


2

Let's say you have multiple openflow enabled switches with virtual and physical hosts connected to the same controller. As long as they are reachable through the network when you link the switch to the controller, controller is aware of them. You can check this in the controller's topology. (Eg: In the case of ovs, you do "ovs-vsctl set-controller br0 tcp::...


Only top voted, non community-wiki answers of a minimum length are eligible