302  SDN Flow Rule Builder

Design Software-Defined Network Rules

302.1 Software-Defined Networking Flow Rules

Software-Defined Networking (SDN) separates the control plane from the data plane, allowing centralized management of network traffic through programmable flow rules. This interactive tool demonstrates how flow rules are composed, installed on switches, and affect packet forwarding.

NoteAbout This Tool

This interactive SDN flow rule builder lets you design a network topology, compose OpenFlow-style rules, visualize rule propagation, and simulate traffic patterns. Learn how SDN enables flexible, policy-driven networking.

TipHow to Use
  1. View the Network Topology with 6 switches and 10 hosts
  2. Use the Flow Rule Composer to create match/action rules
  3. Click Install Rule to visualize rule propagation to switches
  4. Run Traffic Simulation to see packets follow the flow rules
  5. View Flow Tables per switch to see installed rules
  6. Use QoS Templates for common traffic policies
  7. Check Conflict Detection for overlapping rules

302.2 Understanding SDN Flow Rules

302.2.1 OpenFlow Match/Action Model

SDN uses a match/action paradigm where packets are classified by matching header fields and then processed according to defined actions:

%% fig-alt: OpenFlow match-action pipeline showing packet arriving at switch, being matched against flow table entries based on header fields like source IP, destination IP, protocol, and ports, then executing actions like forward, drop, modify, or queue based on the highest priority matching rule.
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#2C3E50', 'primaryTextColor': '#FFFFFF', 'primaryBorderColor': '#16A085', 'lineColor': '#7F8C8D', 'secondaryColor': '#ECF0F1', 'tertiaryColor': '#FFFFFF'}}}%%
flowchart LR
    subgraph Packet["Incoming Packet"]
        P[Headers + Payload]
    end

    subgraph Match["Match Fields"]
        M1[Source IP]
        M2[Dest IP]
        M3[Protocol]
        M4[Ports]
        M5[VLAN]
    end

    subgraph FlowTable["Flow Table"]
        FT[Priority-ordered Rules]
    end

    subgraph Actions["Actions"]
        A1[Forward]
        A2[Drop]
        A3[Modify]
        A4[Queue]
    end

    P --> Match
    Match --> FlowTable
    FlowTable --> Actions


%% fig-alt: Decision tree showing how SDN switches process incoming packets through priority-ordered flow rule matching, with decision points for each match field and outcomes leading to specific actions or table-miss handling.
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#2C3E50', 'primaryTextColor': '#FFFFFF', 'primaryBorderColor': '#16A085', 'lineColor': '#7F8C8D', 'secondaryColor': '#ECF0F1', 'tertiaryColor': '#FFFFFF'}}}%%
flowchart TD
    PKT[Packet Arrives] --> RULE1{Rule 1<br/>Priority: 65535<br/>Match: ICMP}
    RULE1 -->|Match| DROP[DROP<br/>Block ping]
    RULE1 -->|No Match| RULE2{Rule 2<br/>Priority: 50000<br/>Match: VoIP Port 5060}
    RULE2 -->|Match| QUEUE[QUEUE 0<br/>High priority]
    RULE2 -->|No Match| RULE3{Rule 3<br/>Priority: 32768<br/>Match: Dst 10.0.2.x}
    RULE3 -->|Match| FWD[FORWARD<br/>Port 3]
    RULE3 -->|No Match| DEFAULT{Default Rule<br/>Priority: 0<br/>Match: ANY}
    DEFAULT -->|Match| CTRL[PACKET-IN<br/>Send to Controller]

    style PKT fill:#2C3E50,stroke:#16A085,stroke-width:2px,color:#fff
    style DROP fill:#E74C3C,stroke:#2C3E50,stroke-width:2px,color:#fff
    style QUEUE fill:#9B59B6,stroke:#2C3E50,stroke-width:2px,color:#fff
    style FWD fill:#27AE60,stroke:#2C3E50,stroke-width:2px,color:#fff
    style CTRL fill:#E67E22,stroke:#2C3E50,stroke-width:2px,color:#fff
    style RULE1 fill:#7F8C8D,stroke:#2C3E50,stroke-width:1px,color:#fff
    style RULE2 fill:#7F8C8D,stroke:#2C3E50,stroke-width:1px,color:#fff
    style RULE3 fill:#7F8C8D,stroke:#2C3E50,stroke-width:1px,color:#fff
    style DEFAULT fill:#7F8C8D,stroke:#2C3E50,stroke-width:1px,color:#fff

This decision tree shows how packets traverse the flow table from highest to lowest priority. Each rule is evaluated in sequence until a match is found, demonstrating the “first-match-wins” behavior. If no rules match, the default table-miss action sends the packet to the controller for handling.

302.2.2 Flow Rule Components

OpenFlow Flow Entry Components
Component Description Example Values
Match Fields Packet header fields to match IP addresses, ports, protocol
Priority Rule precedence (higher = first) 0-65535
Actions What to do with matched packets Forward, drop, modify
Counters Statistics for matched packets Packet/byte counts
Timeouts Rule expiration Idle/hard timeouts

302.2.3 QoS with SDN

SDN enables sophisticated Quality of Service through:

  • Traffic Classification: Match specific flows (VoIP, video, etc.)
  • Queue Assignment: Direct traffic to appropriate queues
  • Rate Limiting: Meter actions for bandwidth control
  • Priority Marking: Set DSCP/CoS values

302.2.4 Common Flow Rule Patterns

%% fig-alt: "Common SDN flow rule patterns showing four categories - basic forwarding rules that match destination and output to port, security rules that match threats and drop packets, QoS rules that match traffic type and assign queue, and load balancing rules that match service and distribute across servers."
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#2C3E50', 'primaryTextColor': '#FFFFFF', 'primaryBorderColor': '#16A085', 'lineColor': '#7F8C8D', 'secondaryColor': '#ECF0F1', 'tertiaryColor': '#FFFFFF'}}}%%
flowchart TB
    subgraph Basic["Basic Forwarding"]
        B1["Match: dst_ip=10.0.2.0/24<br/>Action: output:port3"]
    end

    subgraph Security["Security Policy"]
        S1["Match: proto=ICMP<br/>Action: DROP"]
    end

    subgraph QoS["QoS Policy"]
        Q1["Match: dst_port=5060<br/>Action: set_queue:0"]
    end

    subgraph LB["Load Balancing"]
        L1["Match: dst_ip=VIP<br/>Action: set_dst:Server1"]
    end

302.3 What’s Next

Explore related networking and architecture topics:

Interactive tool created for the IoT Class Textbook - SDN-FLOW-001