Unless the goal of the backdoor is to redirect traffic flows through packet inspection devices that the attacker also controls, the decoupling of the control and data plane in SDN deployments requires a more creative, intricate solution to allow for wiretapping compared to traditional routers.

Is it really a “back door” when it’s controlled by the network owner? It feels like we need a different term for that since it’s increasingly common on large networks.

What's your view on how these people actually impacted the adoption of SDN in general?

> The investments NSF made in SDN over the past two decades have paid huge dividends.

In my view this seems a little overblown. The general idea of separation of control and data plane is just that - an idea. In practice, none of the early firms (like Nicira) have had any significant impact on what's happening in industry. Happy to be corrected if that's not accurate!

Is this technology used in the Internet core?

Or for de-bundling access networks and Internet service? Where I live, access networks use shared media (broadcast cable or GPON), segregating customers through device and protocol obscurity (no tcpdump) and maybe encryption (but without tcpdump, it is hard to tell). There's not much room for defining anything in software there.

And in data centers, how far does multi-tenancy go in practice? Can tenants push their own P4 programs into hyperscaler infrastructure?

To say nothing of systematically eliminating the foundational infrastructure for nationally funded science in general.

In other words China's success is in part similar what used to make the US successful. Any lessons to be taken from that? No.

> Today's funding (VC or government grants) demands results in 2-3 years

This is nonsense. VCs have been happily investing in technology on 5 to 10 year timelines; traditional VC funds were raised with 7 to 10 year tenors.

> We've systematically eliminated the "patient capital" that creates foundational infrastructure

Did you miss all the space and fusion funding? Biotech? Flying cars? The folks on this board complaining investors have infinite timelines for results?

> The 10-year research-to-production timeline is the key lesson. Today's funding (VC or government grants) demands results in 2-3 years.

Don't forget all the cries of "governments can't do anything, only free market commercial entities can innovate!"

Some problems require time.

It took me 33.5 years to solve a problem that was important to me.

A solution did exist after all. And the conceptual/mathematical walls, mazes, and unexpected territories I was forced to traverse, taught me and gave me knew ways to understand problems.

I also learned the value of luck.

I thought it would take 3-5 months. 3-5 years, at most. (Not as an occupation, but as a side quest.)

Ignorance, incurable optimism, and hope are capricious sirens.

I clearly didn’t understand the problem like I thought. And my “quest” could easily have become a cautionary Don Quixote tale.

That experience gives me great appreciation for the famous organizations and labs that gave many minds the time to pursue, and help each other pursue, hard problems. Whose breakthroughs we still benefit from. Working somewhere like that would be a dream.

>Which seems to have _zero_ mentions outside of academic papers.

Nicira or NVP?

Nicira NVP is now VMware NSX which is pretty successful. AWS/GCP/Azure VPC are also probably inspired by Nicira.

It's all at the big cloud service providers. Not as much focused on the physical network (as originally imagined), but in the overlay networks. Seethe various DPUs like Intel IPU, Nvidia/Mellanox Bluefield, etc. Nvidia DOCA even uses OvS as the sort of example out of the box software to implement networking on Bluefield. When your controller is Arm cores 5 cm away on the same PCB doing per connection setup is no longer as absurd ;)

SDN is great if you're trying to build something like a multi-tenant cloud on top of another network of machines. Your DPUs can handle all the overlay logic as if there was a top of rack switch in each chassis

A lot of mistakes were made. Almost all the code has been thrown away and all the details are different but maybe some of the ideas influenced things that exist today.

To me server/networking hardware companies have a wet dream of manipulating workloads on physical servers the way one manipulates VMs in cloud computing.

Except the dream is to not do it just within a blade enclosure, but across blades in multiple racks, with network based storage in a multi-tennant environment. Maybe even across datacenters.

At some point, dealing (in an automated manner) with discovery, abstraction, and routing across different networking topologies, blade enclosures, rack switches, etc. becomes insane.

Of course a sysadmin with a few shell scripts could practically do the same for meaningful use cases without the general solution’s decade-long engineering effort and vendor lock-in…

i was in close relations with telecoms during that timeframe. they went bananas with it because all of it was new for them. so they abused and misused it.

one of them for example used opendailight not for it's openflow capabilities, but via some heavily customized plugin and kind of orchestrator for automation via some crazy yang models that were sent to execution to downstream orchestrator.

but from their perspective and perspective of the management they were doing SDN

traditional network gear had "element controllers". some of the got rebranded into "SDN*something" and got interface liftups

ps. sdn/openflow like you describe were absolutely out of question for deployment in production networks. they could talk about all the benefits of it, but nobody dared to do anything with it and arguably, they had no real need

Afaik OvS can use pre-programmed flows so doesn't require talking to controller on every new TCP connection - dataplane uses in-kernel conntrack module. Google cloud uses heavily modified OvS for their VM networking (Andromeda) I think some other cloud providers do as well.