【正文】 Four Planes of NetworkingInside every networking and security device every switch, router, and firewall you can separate the software into four layers or planes. As we move to SDN, these planes need to be clearly understood and cleanly separated. This is absolutely essential in order to build the next generation, highly scalable network.ForwardingThe bottom plane, Forwarding, does the heavy lifting of sending the network packets on their way. It is optimized to move data as fast as it can. The Forwarding plane can be implemented in software but it is typically built using applicationspecific integrated circuits (ASIC’s) that are designed for that purpose. Third party vendors supply ASIC’s for some parts of the switching, routing, and firewall markets. For high performance and high scale systems, the Forwarding ASIC’s tend to be specialized and each vendor provides their own, differentiated implementation. Some have speculated that SDN will moditize switching, routing, and firewall hardware. However, the seemingly insatiable demand for network capacity generated by thousands of new consumer and business applications creates significant opportunity for differentiation in Forwarding hardware and networking systems. In fact by unlocking innovation, SDN will allow further differentiation from the vendors who build these systems.Control.If the Forwarding plane is the brawn of the network, Control is the brains. The Control plane understands the network topology and makes the decisions on where the flow of network traffic should go. The Control plane is the traffic cop that understands and decodes the alphabet soup of networking protocols and ensures that the traffic flows smoothly. Very importantly, the Control plane learns everything it needs to know about the network by talking to its peer in other devices. This is the magic that makes the Internet resilient to failures, keeping traffic flowing even when a major storm like Sandy brings down thousands of networking devices.ServicesSometimes network traffic requires more processing and for this, the Services plane does the job. Not all networking devices have a Services plane you won’t find this plane in a simple switch. But for many routers and all firewalls, the Services plane does the deep thinking, performing the plex operations on networking data that cannot be acplished by the Forwarding hardware. Services are the place where firewalls stop the bad guys and parental controls are enforced. They enable your Smartphone to browse the web or stream a video, all the while ensuring you’re properly billed for the privilege. The Services plane is ripe for innovation.ManagementLike all puters, network devices need to be configured, or managed. The Management plane provides the basic instructions of how the network device should interact with the rest of the network. Where the Control plane can learn everything it needs from the network itself, the Management plane must be told what to do. Today’s networking devices are often configured individually. Frequently, they are manually configured using an esoteric mand line interface (CLI), understood by a small number of network specialists. Because the configuration is manual, mistakes are frequent and these mistakes sometimes have serious consequences cutting off traffic to an entire data center or stopping traffic on a crosscountry networking highway. Service providers worry about backhoes cutting fiber optic cables but more frequently, their engineers cut the cable in a virtual way by making a simple mistake in the plex CLI used to configure their network routers or security firewalls.While the Forwarding plane uses special purpose hardware to get its job done, the Control, Services, and Management planes run on one or more general purpose puters. These vary in sophistication and type, from very inexpensive processors within consumer devices to what is effectively a highend server in larger, carrierclass systems. But in all cases today, these general purpose puters use special purpose software that is fixed in function and dedicated to the task at hand. That inflexibility is the root of the issue that has sparked the interest in SDN.If you crawled through the software inside a router or firewall today, you’d find all four of the networking planes. But with today’s software that networking code is built monolithically without cleanly defined interfaces between the planes. What you have today are individual networking devices, with monolithic software, that must be manually configured. This makes everything harder than it needs to be.CentralizationSo if today’s networking software is the root of the problem, better software is the solution and that’s where SDN es in. How do we go from today’s networking software to a modern architecture? We start by looking at the way cloud providers build their software. Amazon, Google, and Facebook use racks of industrystandard, x86 servers running software that is designed to scaleout by adding more servers as the need for capacity increases. The use of industry standard, x86 hardware bined with scaleout software is how modern, highly available systems are built.Unlike most cloud applications, networks are inherently decentralized. That’s really what networks are all about moving data from one place to another. So while Facebook can run in a small number of huge data centers, networks are distributed throughout a data center, over a campus, within a city, or in the case of the Internet, across the entire planet. That’s why networks have always been built as a collection of separate, selfcontained, individually managed devices. But centralization is powerful。 it is a key principle for SDN and it’s very appropriate to apply centralization to networking software. However, you can’t take this too far. Centralization only m