Ay: Kasım 2014

Assalamu alaikum (Peace be upon you) dear friend =)

In this tutorial, I’m going to show you how to make exact IP matching in the Floodlight controller using Mininet, OpenFlow (of course) and Open vSwitch.

Let’s begin with the topology. We have me (Sadican), my workmate (Workmate) and a server (Bilmuh). All of them are connected to an Open vSwitch. Overall network is something like that:

Here are the IP addresses and switch ports for each node:

Me and my workmate want connect to the Bilmuh server. Whenever we try to connect to the server, (if there is no corresponding rule in the switch) switch sends packet-in message to the Floodlight (FL) controller. FL takes this message and extracts IP addresses. Then, it generates exact IP matching rules. There are several important things to do that.

• First of all, FL has to know connected ports of nodes, which are given.
• Secondly, controller must create 4 flow-mod add rules. 2 Rules for ARP packets from one node to another (e.g. Sadican to Bilmuh server and reverse) and 2 rules for TCP connections.
• FL must specify data layer type in matching. For TCP, it is 0x800 and for ARP, it is 0x806. Do not forget that!
• FL must also set both of the network masks to 32 bits (full) for source and destination IP addresses.

For TCP Connections:
match.setWildcards(Wildcards.FULL.matchOn(Flag.IN_PORT)
.matchOn(Flag.DL_TYPE).matchOn(Flag.NW_SRC).matchOn(Flag.NW_DST).withNwSrcMask(32).withNwDstMask(32));
match.setDataLayerType(Ethernet.TYPE_IPv4);
match.setNetworkProtocol(IPv4.PROTOCOL_TCP);

For ARP Connections:
match.setWildcards(Wildcards.FULL.matchOn(Flag.IN_PORT).matchOn(Flag.DL_TYPE).matchOn(Flag.NW_SRC).matchOn(Flag.NW_DST).withNwSrcMask(32).withNwDstMask(32));
match.setDataLayerType(Ethernet.TYPE_ARP);
match.setNetworkProtocol(IPv4.PROTOCOL_TCP);

You can download the Mininet script from here.

You can download the Floodlight module from here. 

If you will test this scenario, you should disable Forwarding and LearningSwitch modules. To do so, open floodlightdefault.properties file and delete the modules. Then, add our module (a.tests.ExactIPMatchingTutorial) in it. Since, they also establish paths between nodes. Here is a screenshot from FL’s UI:

Remarks:
If network source and destination masks are less than 32, exact IP matching becomes prefix matching. Actually, you can try it by changing withNwSrcMask and withNwDstMask to something like 16 or whatever. You will see that there will be less than 8 rules in the switch. It is because some rules overlap and they are removed during addition operation as specified in the OpenFlow version 1.0. Besides, exact IP addresses become prefixed IP addresses. For example, 10.0.0.11 becomes 10.0.0.0.