The prevailing wisdom is that a software-defined network (SDN) operates under the premise that the logically centralized control plane has an accurate representation of the actual data plane state. Unfortunately, bugs, misconfigurations, faults or attacks can introduce inconsistencies between the network control and the data plane that can undermine the correct operation at runtime. Through our experiments, we realize that P4 SDNs are no exception, and are prone to similar problems. With the aim to verify the control-data plane inconsistency, we present the design and implementation of P4Consist, a system to detect the inconsistency between control and data plane in P4 SDNs. P4Consist generates active probe-based traffic continuously or periodically as an input to the P4 SDNs to check whether the actual behavior on the data plane corresponds to the expected control plane behavior. In P4Consist, the control plane and the data plane generate independent reports which are later, compared to verify the control-data plane consistency. The previous works in the field of monitoring and verification mostly aim to test the P4 programs through static analysis and thus, are insufficient to verify the network consistency at runtime. Experiments with our prototype implementation of P4Consist are promising and show that P4Consist can verify the control-data plane consistency in the complex datacenter 4-ary fat-tree (20 switches) and multipath grid (4, 9 and 16 switches) topologies with 60k rules per switch within a minimum time of 4 minutes. At the same time, P4Consist scales to multiple source-destination pairs to detect control-data plane inconsistency.

中文翻译：

---

P4Consist：走向一致的 P4 SDN

普遍的看法是，软件定义网络 (SDN) 在逻辑上集中的控制平面能够准确表示实际数据平面状态的前提下运行。不幸的是，错误、错误配置、故障或攻击可能会在网络控制和数据平面之间引入不一致，从而破坏运行时的正确操作。通过我们的实验，我们意识到 P4 SDN 也不例外，并且容易出现类似的问题。为了验证控制数据平面的不一致，我们介绍了 P4Consist 的设计和实现，这是一个检测 P4 SDN 中控制平面和数据平面不一致的系统。P4Consist 连续或定期生成基于探测的主动流量作为 P4 SDN 的输入，以检查数据平面上的实际行为是否与预期的控制平面行为相对应。在 P4Consist 中，控制平面和数据平面生成独立的报告，稍后进行比较以验证控制-数据平面的一致性。以往在监控和验证领域的工作主要是通过静态分析测试P4程序，因此不足以在运行时验证网络一致性。我们的 P4Consist 原型实现的实验很有希望，并表明 P4Consist 可以验证复杂数据中心 4 叉胖树（20 个交换机）和多路径网格（4，9 和 16 个交换机）拓扑，每个交换机在最短 4 分钟的时间内有 60k 条规则。同时，P4Consist 扩展到多个源-目标对以检测控制-数据平面的不一致。