Abstract: Some embodiments provide a method for an orchestration program instance assigned a particular network device in a network. Each network device of multiple network devices is assigned to a different orchestration program instance in a cluster. The method receives a notification message that a configuration for the particular network device has been modified. In response to the notification message, the method identifies a set of network correctness requirements to be evaluated for the network. The method sends a separate notification message for each identified network correctness requirement specifying that the particular network device configuration has been modified so that a set of evaluation program instances can re-evaluate any network correctness requirements dependent on the particular network device.

Abstract: Some embodiments provide a method for evaluating a network correctness requirement at an evaluation program instance assigned to evaluate a particular network correctness requirement. The method identifies data message properties associated with the particular network correctness requirement. The method evaluates the particular network correctness requirement by (i) determining a path through a set of network devices for a data message having the identified data message properties and (ii) from a data storage that stores data message processing rules for a plurality of network devices including the set of network devices and additional network devices, retrieving and storing in memory data specifying data message processing rules for the set of network devices to use in evaluating the particular network correctness requirement.

Abstract: Some embodiments provide a method for evaluating a network. The method identifies multiple network correctness requirements configured for the network. The method instantiates a separate respective evaluation program instance for each respective identified network correctness requirement to evaluate the respective network correctness requirement. At least two evaluation program instances are instantiated on different machines. Each respective evaluation program instance stores in a respective memory a respective set of network device data to evaluate the respective network correctness requirement. Each set of network device data requires less memory than storing network device data for the entire network.

Abstract: Some embodiments provide a method. The method determines a forwarding path for a packet set by using a data plane model of a network. The method identifies a rule table implementing a step in the forwarding path of the packet set. The method retrieves an indexing file at a scalable storage based on the identified rule table. The indexing file stores rule entries for one or more rule tables of the network. The method retrieves provenance data regarding a rule of the rule table that is applicable to the packet set from the indexing file. The method presents the retrieved provenance information of the identified rule.

Abstract: A network insight system that performs intent verification of network changes is provided. The system generates a first model of a network comprising a first set of one or more rule tables, each rule table described by one or more flow nodes. The system generates a second model of the network comprising a second set of one or more rule tables. Each rule table is described by one or more flow nodes. Each flow node specifies a set of packets and an action to be taken on the specified set of packets. They system determines a set of differential flow nodes for the second model based on the flow nodes of the first model and the flow nodes of the second model. Each differential flow node is classified as being one of (i) newly removed, (ii) newly added, and (iii) unaffected. The system verifies a network change based on the determined differential flow nodes.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed herein to formally verify a network with both physical and virtual components. The modeling and formal verification is performed by an apparatus comprising: a topology generator to generate a network model including a plurality of devices connected in a network; a flow modeler to add a rule to the network model, the rule to define a flow of network packets through the network model; a reduction mapper to identify the rules common to ones of the devices; and a mapping verifier to verify the network meets a user specification.

Abstract: Systems for and methods of modelling, analyzing and managing data networks are provided. In an embodiment, a plurality of network device interfaces are configured to collect state information for a plurality of network devices. A computer-implemented model of the network comprises a data structure, which may be graph-based. The data structure comprises a plurality of snapshots of the network, each snapshot representing the network at a particular point in time, and the data structure comprises a representation of possible data flow and data packet processing within the network. The data structure contains normalized representations of the network devices corresponding to the location. The normalized representation for each device contains a set of packet processing rules. A user-interface is configured to receive queries from a user that request verification of network policies and predictions of network behavior.

Abstract: An example method of packet forwarding for a packet set in a network device includes: selecting a first bit pattern of multiple adjacent bits from a bit string that represents an input packet set; selecting a second bit pattern of multiple adjacent bits from a first node of a data structure that implements a prefix-compressed decision diagram representing a first class of packets; performing a comparison of the first bit pattern to the second bit pattern; generating an output packet set, which is a subset of the input packet set, in response to the first bit pattern matching the second bit pattern; and applying a network forwarding action to the output packet set, the network forwarding action associated with the prefix-compressed decision diagram and dictating packet forwarding behavior of the network device with respect to the output packet set.