Switch as a Verifier: Toward Scalable Data Plane Checking via Distributed, On-Device Verification

TL;DR

This paper introduces Coral, a distributed on-device data plane verification framework that transforms DPV into a scalable counting problem, enabling efficient, decentralized network error detection with significant speedups over existing centralized tools.

Contribution

Coral presents a novel distributed verification framework with a declarative language, a systematic decomposition method, and an efficient communication protocol, addressing the scalability limitations of centralized DPV.

Findings

Achieves up to 1250x speedup in burst update scenarios.

Up to 202x speedup on 80% quantile of incremental verification.

Demonstrates scalability and efficiency on real-world network datasets.

Abstract

Data plane verification (DPV) is important for finding network errors. Current DPV tools employ a centralized architecture, where a server collects the data planes of all devices and verifies them. Despite substantial efforts on accelerating DPV, this centralized architecture is inherently unscalable. In this paper, to tackle the scalability challenge of DPV, we circumvent the scalability bottleneck of centralized design and design Coral, a distributed, on-device DPV framework. The key insight of Coral is that DPV can be transformed into a counting problem on a directed acyclic graph, which can be naturally decomposed into lightweight tasks executed at network devices, enabling scalability. Coral consists of (1) a declarative requirement specification language, (2) a planner that employs a novel data structure DVNet to systematically decompose global verification into on-device counting tasks, and (3) a distributed verification (DV) protocol that specifies how on-device verifiers communicate task results efficiently to collaboratively verify the requirements. We implement a prototype of Coral. Extensive experiments with real-world datasets (WAN/LAN/DC) show that Coral consistently achieves scalable DPV under various networks and DPV scenarios, i.e., up to 1250 times speed up in the scenario of burst update, and up to 202 times speed up on 80% quantile of incremental verification, than state-of-the-art DPV tools, with little overhead on commodity network devices.