Abstract: A method implemented by a first controller in a software defined networking (SDN) network to monitor a health of a second controller, where the first controller and the second controller are part of a cluster of controllers, where controllers in the cluster communicate with switches over an in-band network, and where controllers in the cluster communicate with each other over an out-of-band network. The method includes sending a first control message to a switch over the in-band network in response to a determination that the second controller cannot be reached over the out-of-band network, where the first control message includes a health check request message and an instruction for the switch to send the health check request message to the second controller, and where the switch is a designated switch that has a control channel connection to the first controller and the second controller over the in-band network.

Abstract: A method by a software defined networking (SDN) controller to configure a switch to perform translation module bypass in a container orchestration system. The method includes receiving a translation rule for a flow from a load balancer, sending translation module bypass instructions to a switch in response to receiving the translation rule for the flow, where the translation module bypass instructions include instructions for the switch to stop sending packets belonging to the flow to the translation module and to apply a network address translation specified by the translation rule for the flow to the packets belonging to the flow, and send an indication to the load balancer that the packets belonging to the flow are to bypass the translation module to cause the load balancer to disable timeout processing for the flow in the translation module.

Abstract: A method is implemented by a switch in a software defined networking (SDN) network managed by a controller to achieve hitless resynchronization during a controller upgrade. The method includes installing an upgraded set of flow entries so that a packet processing pipeline of the switch includes both a non-upgraded set of flow entries and the upgraded set of flow entries, processing non-tunneled packets using the non-upgraded set of flow entries, processing tunneled packets that have a tunnel upgrade status indicator set in a tunnel header using the non-upgraded set of flow entries, while processing tunneled packets that do not have a tunnel upgrade status indicator set in a tunnel header using the upgraded set of flow entries, and processing non-tunneled packets using the upgraded set of flow entries after all switches managed by the controller have installed upgraded flow entries.

Abstract: Methods for tracing a packet in a pipeline comprising a set of tables, in an SDN using OpenFlow. The packet comprises a trace bit, and is provided with a TTL value. A first network node indicates to a second network node to have each flow table decrement the TTL value by 1, based upon the trace bit. The first network node initially sets the TTL to be 1, and then sends the packet to a first table in the second network node. The first network node receives the packet, from another table in the set, and for every remaining table, and one table at a time: a) increments the TTL value by 1, and b) repeats the sending, and the receiving, until a last table is reached or a criterion is met. The first network node then indicates a route followed by the packet.

Abstract: A method is implemented by a network device where the method performs a trace flow process in a packet processing pipeline of the network device. The packet processing pipeline includes a trace table and a forward table. The method encompasses forwarding a trace packet to the trace table, forwarding a copy of the trace packet to a trace analyzer in response to determining that a trace bit is set in the trace packet, forwarding the trace packet to the forward table, and determining a next stage of the packet processing pipeline based on trace packet meta data and a value stored in a trace register.

Abstract: A method is implemented by a network device for enabling destination network address translation in a cloud network. The method includes determining that packets having a first public address as a source address and a second public address as a destination address are to be forwarded to a first host that is assigned a first private address and sending a first advertisement message to a gateway indicating that packets having the first public address as a source address and the second public address as a destination address are to be forwarded to a first switch connected to the first host, where the first switch is configured to translate the destination address of those packets from the second public address to the first private address assigned to the first host.

Abstract: A method by a first controller in a software defined networking (SDN) network for programming a switch in the SDN network to use a controller port as a watch port. The method includes generating an instruction for the switch to create a first group entry for a first group in a packet processing pipeline of the switch, where the first group entry includes a first bucket that specifies a first controller port as a watch port and an action for the switch to forward packets to the first controller via the first controller port, where the first controller port being specified as the watch port in the first bucket indicates that execution of the action specified by the first bucket is to be contingent upon a liveness of the first controller port and sending the instruction to the switch to cause the switch to create the first group entry.

Abstract: A system for tracing packets in a Software Defined Networking (SDN) network. The system includes a switch and an SDN controller communicatively coupled to the switch. The SDN controller is configured to program a packet processing pipeline of the switch to cause the switch to determine, at a first flow table of the packet processing pipeline, whether a packet is a trace packet that was recirculated based on content of a first field associated with the packet and in response to a determination that the packet is a trace packet that was recirculated, set a first field associated with the packet to indicate that tracing is disabled for the packet, set a second field associated with the packet to indicate that tracing is enabled for the packet, determine a flow table of the packet processing pipeline from which the packet was recirculated, and direct the packet to that flow table.

Abstract: A method is implemented by a switch in a software defined networking (SDN) network to trace packets in a packet processing pipeline of the switch. The method includes creating a copy of a received packet to function as a trace packet. The method further includes, at each of one or more subsequent flow tables that the trace packet traverses, appending an identifier of that flow table to a recorded route of the trace packet and resubmitting the trace packet to that flow table to be processed without packet tracing. The method further includes sending, at an egress table, the trace packet to a controller along with the recorded route of the trace packet.

Abstract: A method implemented by a first switch in a software defined networking (SDN) network to monitor a tunnel between the first switch and a second switch in the SDN network. The method includes generating a first flow entry that matches packets received over the tunnel, generating a second flow entry that matches packet received over the tunnel, where the second flow entry has a priority that is lower than a priority of the first flow entry, removing the first flow entry and transmitting a flow removed message to an SDN controller in response to a determination that the first flow entry has timed out, maintaining a statistic associated with the second flow entry, and transmitting a statistics trigger event message to the SDN controller in response to a determination that the statistic associated with the second flow entry exceeds a threshold value.

Abstract: A method by a software defined networking (SDN) controller to configure a switch to perform translation module bypass in a container orchestration system. The method includes receiving a translation rule for a flow from a load balancer, sending translation module bypass instructions to a switch in response to receiving the translation rule for the flow, where the translation module bypass instructions include instructions for the switch to stop sending packets belonging to the flow to the translation module and to apply a network address translation specified by the translation rule for the flow to the packets belonging to the flow, and send an indication to the load balancer that the packets belonging to the flow are to bypass the translation module to cause the load balancer to disable timeout processing for the flow in the translation module.

Abstract: A method implemented by a switch in a software defined networking (SDN) network to monitor a service node communicatively coupled to the switch. The method includes generating a first flow entry that matches packets received from the service node, generating a second flow entry that matches packet received from the service node, wherein the second flow entry has a priority that is lower than a priority of the first flow entry, removing the first flow entry and transmitting a flow removed message to an SDN controller in response to a determination that the first flow entry has timed out, maintaining a statistic associated with the second flow entry, and transmitting a statistics trigger event message to the SDN controller in response to a determination that the statistic associated with the second flow entry exceeds a threshold value.

Abstract: A method is implemented by a network device for enabling destination network address translation in a cloud network. The method includes determining that packets having a first public address as a source address and a second public address as a destination address are to be forwarded to a first host that is assigned a first private address and sending a first advertisement message to a gateway indicating that packets having the first public address as a source address and the second public address as a destination address are to be forwarded to a first switch connected to the first host, where the first switch is configured to translate the destination address of those packets from the second public address to the first private address assigned to the first host.

Abstract: A method is implemented by a switch in a Software Defined Networking (SDN) network to trace packets, where the switch includes a packet processing pipeline that includes a plurality of flow tables. The method includes receiving a packet, determining, at a first flow table of the packet processing pipeline, whether the packet is a trace packet that was recirculated based on content of a first field associated with the packet, and in response to a determination that the packet is trace packet that was recirculated, setting a first field associated with the packet to indicate that tracing is disabled for the packet, setting a second field associated with the packet to indicate that tracing is enabled for the packet, determining a flow table of the packet processing pipeline from which the packet was recirculated, and directing the packet to the flow table from which the packet was recirculated.

Abstract: A method implemented by a network device to reduce bandwidth and compute resources needed by a controller of a software defined networking (SDN) network by distributing monitoring of nodes connected to data plane nodes (DPNs) in an SDN network. The method determines whether a received response message from a node indicates proper operation, inserts parameters of the received response message into a template for a stateful request message, and sends the stateful request message to the node.

Abstract: A method implemented by a switch in a Software Defined Networking (SDN) network to trace packets in the SDN network, where the switch includes a packet processing pipeline. The method includes receiving a first packet, determining, at a first flow table of the packet processing pipeline, whether the first packet is to be traced, punting a copy of the first packet to an SDN controller and directing the first packet to a second flow table of the packet processing pipeline in response to a determination at the first flow table that the first packet is to be traced.

Abstract: Methods for tracing a packet in a pipeline comprising a set of tables, in an SDN using OpenFlow. The packet comprises a trace bit, and is provided with a TTL value. A first network node indicates to a second network node to have each flow table decrement the TTL value by 1, based upon the trace bit. The first network node initially sets the TTL to be 1, and then sends the packet to a first table in the second network node. The first network node receives the packet, from another table in the set, and for every remaining table, and one table at a time: a) increments the TTL value by 1, and b) repeats the sending, and the receiving, until a last table is reached or a criterion is met. The first network node then indicates a route followed by the packet.

Abstract: A method is implemented by a network device where the method performs a trace flow process in a packet processing pipeline of the network device. The packet processing pipeline includes a trace table and a forward table. The method encompasses forwarding a trace packet to the trace table, forwarding a copy of the trace packet to a trace analyzer in response to determining that a trace bit is set in the trace packet, forwarding the trace packet to the forward table, and determining a next stage of the packet processing pipeline based on trace packet meta data and a value stored in a trace register.

Abstract: A method is implemented by a switch in a software defined networking (SDN) network managed by a controller to achieve hitless resynchronization during a controller upgrade. The method includes installing an upgraded set of flow entries so that a packet processing pipeline of the switch includes both a non-upgraded set of flow entries and the upgraded set of flow entries, processing non-tunneled packets using the non-upgraded set of flow entries, processing tunneled packets that have a tunnel upgrade status indicator set in a tunnel header using the non-upgraded set of flow entries, while processing tunneled packets that do not have a tunnel upgrade status indicator set in a tunnel header using the upgraded set of flow entries, and processing non-tunneled packets using the upgraded set of flow entries after all switches managed by the controller have installed upgraded flow entries.

Abstract: A method is implemented by a switch in a software defined networking (SDN) network to trace packets in a packet processing pipeline of the switch. The method includes creating a copy of a received packet to function as a trace packet. The method further includes, at each of one or more subsequent flow tables that the trace packet traverses, appending an identifier of that flow table to a recorded route of the trace packet and resubmitting the trace packet to that flow table to be processed without packet tracing. The method further includes sending, at an egress table, the trace packet to a controller along with the recorded route of the trace packet.