Abstractions for network update
Open accessAbstract
Configuration changes are a common source of instability in networks, leading to outages, performance disruptions, and security vulnerabilities. Even when the initial and final configurations are correct, the update process itself often steps through intermediate configurations that exhibit incorrect behaviors. This paper introduces the notion of consistent network updates---updates that are guaranteed to preserve well-defined behaviors when transitioning mbetween configurations. We identify two distinct consistency levels, per-packet and per-flow, and we present general mechanisms for implementing them in Software-Defined Networks using switch APIs like OpenFlow. We develop a formal model of OpenFlow networks, and prove that consistent updates preserve a large class of properties. We describe our prototype implementation, including several optimizations that reduce the overhead required to perform consistent updates. We present a verification tool that leverages consistent updates to significantly reduce the complexity of checking the correctness of network control software. Finally, we describe the results of some simple experiments demonstrating the effectiveness of these optimizations on example applications.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
NetOps has a higher safety bar than many AIOps settings because a single incorrect change can propagate quickly, trigger large blast-radius outages, or create hard-to-debug transient behaviours during convergence.
“At the same time, NetOps has a higher safety bar than many AIOps settings because a single incorrect change can propagate quickly, trigger large blast-radius outages, or create hard-to-debug transient behaviours during convergence [47], [11], [108], [109].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
The introduction (-Heraclitus; page unavailable) says network updates can cause transient outages and other disruptions. The discussion of intermediate update states (page unavailable) describes delays across switches and a combinatorial explosion of possible behaviours, supporting the concern about difficult-to-debug transitions. The paper does not compare NetOps with AIOps or establish that one incorrect change propagates quickly or causes a large-blast-radius outage. (LLM, conf=0.86)
Experimental — accuracy not yet measuredTrusted systems leave traces that can be reviewed, act with care during uncertainty, and recover when things go off plan.
“trusted systems leave traces that can be reviewed, act with care during uncertainty, and recover when things go off plan [72], [11], [105], [4].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
The paper’s “Deploying Trace Verification” section describes checking network configurations before and after updates, and its update example describes taking care to avoid unsafe intermediate configurations. But its trace properties describe possible packet paths, not reviewable records left by a system; the cited passages also do not describe recovery when an update goes wrong. No page numbers are available in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredFinding new configurations addresses only one aspect of the problem; the real challenge lies in deploying these changes without causing temporary violations or disruptions.
“As network operations have shown, finding new configurations addresses only one aspect of the problem.The real challenge lies in deploying these changes without causing temporary violations or disruptions [11].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
Even correct end states can be reached through unsafe intermediate states, such as loops, blackholes, or policy violations during rollout, because updates are applied under asynchronous convergence and partial deployment.
“Even correct end states can be reached through unsafe intermediate states, such as loops, blackholes, or policy violations during rollout, because updates are applied under asynchronous convergence and partial deployment [11], [47], [46].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
A change may be correct in its final state yet unsafe while it is being applied.
“A change may be correct in its final state yet unsafe while it is being applied, so the agent should stage the change, run a canary, validate the result, and only then widen the rollout [11], [73], [41].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
Work on consistent updates formalises that correct end states can still be reached through unsafe transient states, so deployment must be treated as a protocol.
“Work on consistent updates formalises the central risk: correct end states can still be reached through unsafe transient states, so deployment must be treated as a protocol [11].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
The agent does not act in an unconstrained action space; it acts within an autonomy rung k, defined by tool permissions and mandatory gates that must be satisfied before any write-side action is executed.
“The agent does not act in an unconstrained action space.It acts within an autonomy rung k, which is defined by the tool permissions and the mandatory gates that must be satisfied before any write-side action is executed [3], [11].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
The section headed “3. Update F2 to deny SSH packets” describes a library for network updates and an optional `verify` command for checking a security policy (page unavailable). Neither that passage nor the retrieved passages on update ordering address an agent’s autonomy rung, tool permissions, or mandatory gates before write-side actions; searches for those terms and for authorization before updates found no such model. (LLM, conf=0.76)
Experimental — accuracy not yet measuredRollback rate captures real-world dynamics and recovery readiness.
“Captures real-world dynamics and recovery readiness [11], [105]”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [11]
The Results and analysis section measures OpenFlow operations and extra-rule overhead during configuration updates, not rollback rate. Searches for “rollback rate” and “recovery readiness” found no passage in our copy saying that rollback rate captures real-world dynamics or recovery readiness. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 21
- P. Francois and O. Bonaventure, "Avoiding transient loops during the convergence of link-state routing protocols," IEEE/ACM Trans. on Networking, Dec 2007.
- P. Francois, P.-A. Coste, B. Decraene, and O. Bonaventure, "Avoiding disruptions during maintenance operations on BGP sessions," IEEE Trans. on Network and Service Management, Dec 2007.
- S. Raza, Y. Zhu, and C.-N. Chuah, "Graceful network state migrations," IEEE/ACM Trans. on Networking, vol. 19, Aug 2011.
- D. Erickson et al., "A demonstration of virtual machine mobility in an OpenFlow network," Aug 2008. Demo at ACM SIGCOMM.
- L. Vanbever, S. Vissicchio, C. Pelsser, P. Francois, and O. Bonaventure, "Seamless network-wide IGP migration," in ACM SIGCOMM, Aug 2011.
- N. Handigol, S. Seetharaman, M. Flajslik, N. McKeown, and R. Johari, "Plug-n-Serve: Load-balancing web traffic using OpenFlow," Aug 2009. Demo at ACM SIGCOMM.
- P. Francois, M. Shand, and O. Bonaventure, "Disruption-free topology reconfiguration in OSPF networks," in IEEE INFOCOM, May 2007.
- J. P. John, E. Katz-Bassett, A. Krishnamurthy, T. Anderson, and A. Venkataramani, "Consensus routing: The Internet as a distributed system," in NSDI, Apr 2008.
- N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, "Openflow: Enabling innovation in campus networks," SIGCOMM CCR, vol. 38, no. 2, pp. 69-74, 2008.
- M. Canini, D. Venzano, P. Peresini, D. Kostic, and J. Rexford, "A NICE way to test OpenFlow applications," in NSDI, Apr 2012.
- Y. Bertot and P. Casteran, "Interactive theorem proving and program development: Coq'Art the calculus of inductive constructions," in EATCS Texts in Theoretical Computer Science, Springer-Verlag, 2004.
- A. Cimatti, E. Clarke, E. Giunchiglia, F. Giunchiglia, M. Pistore, M. Roveri, R. Sebastiani, and A. Tacchella, "NuSMV 2: An opensource tool for symbolic model checking," pp. 359-364, Springer, 2002.
- P. Kazemian, G. Varghese, and N. McKeown, "Header space analysis: Static checking for networks," in NSDI, Apr 2012.
- E. M. Clarke, E. A. Emerson, and A. P. Sistla, "Automatic verification of finite-state concurrent systems using temporal logic specifications," ACM Transactions on Programming Languages and Systems, vol. 8, pp. 244-263, 1986.
- B. M. Waxman, "Broadband switching," ch. Routing of Multipoint Connections, pp. 347-352, IEEE Computer Society Press, 1991.
- J. Mogul, J. Tourrilhes, P. Yalagandula, P. Sharma, A. Curtis, and S. Banerjee, "DevoFlow: Scaling flow management for high-performance networks," in ACM SIGCOMM, Aug 2011.
- N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenker, "NOX: Towards an operating system for networks," SIGCOMM CCR, vol. 38, no. 3, 2008.
- D. Katabi, N. Kushman, and J. Wrocklawski, "A Consistency Management Layer for Inter-Domain Routing," Tech. Rep. MIT-CSAIL-TR-2006-006, Cambridge, MA, Jan 2006.
- S. Ajmani, B. Liskov, and L. Shrira, "Modular software upgrades for distributed systems," in Proceedings of the 20th European conference on Object-Oriented Programming, ECOOP'06, (Berlin, Heidelberg), pp. 452-476, Springer-Verlag, 2006.
- C. C. Zhang, M. Winslett, and C. A. Gunter, "On the safety and efficiency of firewall policy deployment," in IEEE Symp. on Security and Privacy, 2007.
- N. Feamster and H. Balakrishnan, "Detecting BGP configuration faults with static analysis," in NSDI, May 2005.
Cited by
Sorted by citations
A Survey of Software-Defined Networking: Past, Present, and Future of Programmable Networks
Nunes, B. A. A., Mendonca, M., Nguyen, X.-N., Obraczka, K., & Turletti, T. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2014.012214.00180 · Cited by 2,203 · see citing works
A roadmap for traffic engineering in SDN-OpenFlow networks
Akyildiz, I. F., Lee, A., Wang, P., Luo, M., & Chou, W. (2014) · Computer Networks · doi:10.1016/j.comnet.2014.06.002 · Cited by 536 · see citing works
A survey of edge computing-based designs for IoT security
Sha, K., Yang, T. A., Wei, W., & Davari, S. (2020) · Digital Communications and Networks · doi:10.1016/j.dcan.2019.08.006 · Cited by 295 · see citing works
Hybrid SDN evolution: A comprehensive survey of the state-of-the-art
Khorsandroo, S., Sánchez, A. G., Tosun, A. S., Arco, J., & Doriguzzi-Corin, R. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.107981 · Cited by 111 · see citing works
Achieving Fast and Lightweight SDN Updates with Segment Routing
Luo, L., Yu, H., Luo, S., Zhang, M., & Yu, S. (2016) · 2016 IEEE Global Communications Conference (GLOBECOM) · doi:10.1109/glocom.2016.7841562 · Cited by 14 · see citing works
- Authors
- Reitblatt, M., Foster, N., Rexford, J., Schlesinger, C., & Walker, D.
- Affiliations
- Cornell University (US)
- Princeton University (US)
- Venue
- Proceedings of the ACM SIGCOMM 2012 conference on Applications, technologies, architectures, and protocols for computer communication
- Publisher
- ACM
- Published
- 2012-08-13
- Pages
- 323-334
- OpenAlex
- W2149236835
- Cited by
- 584
- References
- 0
- Citations by year
- 2026: 4 · 2025: 2 · 2024: 6 · 2023: 7 · 2022: 17 · 2021: 20 · 2020: 36 · 2019: 62 · 2018: 55 · 2017: 59 · 2016: 94 · 2015: 71 · 2014: 84 · 2013: 57 · 2012: 10
- Type
- conference abstract
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGCOMM Conference (SIGCOMM) (publishedVersion)
- Funders
- National Science Foundation (1111520, 1111698, 0964409, 1016937)
- Office of Naval Research (N00014-09-1-0770, N00014)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Physical Sciences › Computer Science › Computer Networks and Communications › Distributed systems and fault tolerance
- Physical Sciences › Engineering › Electrical and Electronic Engineering › Advanced Optical Network Technologies
- Keywords
- network configuration changes, software-defined networking, OpenFlow, network stability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
