Network data plane verification : a tradeoff between probability of correctness and computational cost

Abstract

Traditional and SDN Networks are increasingly more complex and covering more use-cases making reasoning about network behavior all-the-more challenging. Dedicated tools to verify networks for reachability and other invariants exist, but not without scalability limitations as these problems are combinatorially complex. Workarounds that exploit regularities to minimize processing exist, but they depend on data-plane properties that are not guaranteed to exist in SDN networks, especially as more use-cases are being applied with packet headers used in unconventional ways. We propose a tradeoff between the probability of correctness, based on network traffic statistics, and the verification computational cost. Such a tool gives operators the flexibility and freedom to select their own preference in this tradeoff, while making feasible a partial solution of cases that require exponential or factorial time. We represent the network as a Markov Chain, and propose a prioritized traversal algorithm to verify reachability questions. We test our algorithm on randomly generated networks of varying complexities and traffic distributions, proving the effectiveness of our method for high-complexity networks and the efficacy of our traversal algorithm in taking advantage of skewness in traffic weights. We were able to achieve 99percent traffic path probability coverage in 2.45percent (and 95percent traffic path probability coverage in 0.57percent) of the time needed for full coverage on randomly-generated test networks.