How does OpenFlow actually work, and why did it not take over the network?
Show the answer
Say this first
An OpenFlow switch holds flow tables. Each entry has match fields, a priority, counters, instructions or actions and timeouts. The controller connects to the switch over TCP 6653 (optionally TLS), installs entries with Flow-Mod messages, and gets packets that miss every entry through Packet-In. It stayed niche because switch TCAM is small, reactive flow setup does not scale, and operators preferred proven distributed protocols with central policy on top.
Go deeper
The pieces
- Flow entry. Match on ingress port, MACs, EtherType, VLAN, IP addresses, protocol, L4 ports (OpenFlow 1.0 had 12 match fields; later versions added many more). Highest priority match wins.
- Actions. Output to a port, drop, rewrite a header field, push or pop a VLAN tag, send to the controller.
- Table-miss. A priority 0 entry that drops or sends to the controller.
- Messages. Hello, Features Request and Reply, Flow-Mod, Packet-In, Packet-Out, Port-Status, Echo.
Reactive vs proactive
- Reactive. The first packet of a new flow goes to the controller, which installs an entry. Flexible, but every new flow costs a round trip, and the controller becomes the bottleneck.
- Proactive. The controller installs entries in advance from known topology and policy. Scales far better and survives a controller outage.
Versions
OpenFlow 1.1 and later added multiple tables in a pipeline and group tables. 1.3 added meters and became the most widely implemented version. The old controller port was 6633; IANA later assigned 6653.
Where it lived on
Open vSwitch in hypervisors and OpenStack, Google's B4 inter-datacenter WAN, and research. Its ideas moved into P4, programmable pipelines and controller-based fabrics.
$ ovs-ofctl dump-flows br0
cookie=0x0, duration=120.345s, table=0, n_packets=42, n_bytes=3528, priority=100,ip,nw_dst=10.0.0.2 actions=output:2
cookie=0x0, duration=300.012s, table=0, n_packets=7, n_bytes=420, priority=0 actions=CONTROLLER:65535They will ask next
How does an OpenFlow switch learn MAC addresses?
It does not, by itself. A controller application (for example a learning switch app) sees the Packet-In, records the source MAC and port, and installs entries. All the "intelligence" lives in the controller apps.
What happens to traffic if the controller dies?
Existing entries keep forwarding until their idle or hard timeouts expire. New flows that need the controller fail. OpenFlow defines fail-secure mode (keep using the table, drop what misses) and fail-standalone mode (fall back to normal switching), and which one you get depends on the switch.
Traps
- Saying OpenFlow is a routing protocol. It programs forwarding state; it does not compute paths.
- Quoting only 6633. Know that 6653 is the assigned port.