An Extensible Automated Failure Localization Framework Using NetKAT, Felix, and SDN Traceroute

Abstract

Designing, implementing, and maintaining network policies that protect from internal and external threats is a highly non-trivial task. Often, troubleshooting networks consisting of diverse entities realizing complex policies is even harder. Software-defined networking (SDN) enables networks to adapt to changing scenarios, which significantly lessens human effort required for constant manual modifications of device configurations. Troubleshooting benefits SDN’s method of accessing forwarding devices as well, since monitoring is made much easier via unified control channels. However, by making policy changes easier, the job of troubleshooting operators is made harder too: For humans, finding, analyzing, and fixing network issues becomes almost intractable. In this paper, we present a failure localization framework and its proof-of-concept prototype that helps in automating the investigation of network issues. Like a controller for troubleshooting tools, our framework integrates the formal specification (expected behavior) and network monitoring (actual behavior) and automatically gives hints about the location and type of network issues by comparing the two types of information. By using NetKAT (Kleene algebra with tests) for formal specification and Felix and SDN traceroute for network monitoring, we show that the integration of these tools in a single framework can significantly ease the network troubleshooting process.

Explaining Safety Failures in NetKAT

“…The results in [9] introduce a framework for automated failure localisation in NetKAT. The approach in [9] relies on the generation of test cases based on the network specification, further used to monitor the network traffic accordingly and localise faults whenever tests are not satisfied. In contrast, our approach provides explanations for possible failures irrespective of particular input packets.…”

Explaining SDN Failures via Axiomatisations

“…Related to the current work, the results in [24] introduce a framework for automated failure localisation in NetKAT. The approach in [24] relies on the generation of test cases based on the network specification, further used to monitor the network traffic accordingly and localise faults whenever tests are not satisfied. In contrast, our approach falls under the umbrella of equivalence checking, and it provides an explanation for all possible failures, irrespective of particular input packets.…”