Summary

  • Ethane put an explicit policy decision before a previously unmatched enterprise flow could acquire an authorised path. Its important dependency was the binding between a user, a host, addresses and an ingress location.
  • NOX separated a network-wide programming view from switch-local forwarding. Neither that abstraction nor a successful admission decision proved that an application was harmless.

A guest may be permitted to browse the web through a proxy without being permitted to reach every machine in an office. The routing system can find a path to the destination. It does not, by that fact, know whether the guest should use it. This illustrative case identifies the decision around which Scott Shenker and his collaborators built a different enterprise-network architecture: permission had to become an executable condition of connectivity, rather than an intention assembled from scattered configurations.

The 2007 Ethane paper, by Martin Casado, Michael J. Freedman, Justin Pettit, Jianying Luo, Nick McKeown and Scott Shenker, proposed three linked commitments. Policy would use recognisable names such as users and hosts. Policy would determine the path, including required intermediate equipment. The network would maintain a binding between a packet and its origin. Reading only the first commitment misses the demanding part: a rule about a named person is useful only while the network can associate that person with the traffic being admitted.

The permission becomes a path

In Ethane, a switch receiving a packet without a matching flow-table entry sends it to the controller with ingress information. The controller evaluates permission, computes an allowed route and installs entries along that route. It can require a waypoint such as a proxy. The first packet is then returned for forwarding; later matching packets are handled by the switches. Entries eventually expire or can be revoked.

This is not a design in which one server forwards every packet. The distinction is operationally consequential. Fast forwarding and the decision to admit new communication have different dependencies. An organisation assessing availability should therefore test new admissions separately from already-installed forwarding, rather than equating controller reachability with one undifferentiated measure of network health. That is an implication of the mechanism, not a promise that existing communication survives every failure.

Ethane's example builds its identity chain through host registration, address assignment, attachment information and user authentication. A moving machine can require the controller to update its bindings. Journalling registrations and bindings can make a historical address meaningful during investigation: an address observed yesterday need not identify the same user today. The valuable record is the association at the time of the decision, not an address treated as a permanent identity.

A working experiment with stated limits

The paper reports more than 300 hosts supported over four months at Stanford. That provides deployment experience, including coexistence with legacy equipment and no required changes to end-host software. It does not mean the authors deployed the much larger networks discussed in their controller-sizing argument. Nor does gradual installation give every legacy access segment identical enforcement properties.

The paper's shortcomings section is unusually important to the thesis. If an allowed intermediate host relays application messages onward, connectivity rules alone may not preserve the intended prohibition. A transport port is also an imperfect description of what an application does. When several hosts share a switch port, MAC-address impersonation complicates origin attribution. Broadcast service discovery creates another management burden. These are acknowledged boundaries, not discoveries that negate the experiment.

They show why a clean statement of permission cannot replace endpoint trust, protocol interpretation and careful attachment design.

Giving applications a network-wide view

The NOX author manuscript, associated with the 2008 CCR contribution, extended the management argument into a programming environment. Its authors are Natasha Gude, Teemu Koponen, Justin Pettit, Ben Pfaff, Martin Casado, Nick McKeown and Scott Shenker. The captured document explicitly describes itself as a non-peer-reviewed editorial note; its arguments should not be presented as an independent security certification.

NOX distinguishes the network-wide abstraction from OpenFlow's abstraction of a switch. Management applications make the decisions; the platform supplies observation and control. Its network view includes topology and name–address bindings, but not all current traffic state. The authors separate packet processing, flow initiation and slower changes to the shared view, rather than demanding global coordination for every packet. The note reports an internal network of roughly 30 hosts over six months. Its scaling argument is broader than that observed installation.

Berkeley's faculty record identifies Scott Shenker's academic position; a dated institutional report confirms his Nicira cofounding. Those credentials do not allocate the private work among the paper's coauthors. The enduring contribution visible in these documents is collaborative and architectural: make policy speak in useful names, then expose the machinery that connects those names to an enforceable action.

Sources and evidence boundaries

The original Ethane paper supports the mechanism, observed deployment and shortcomings. The NOX manuscript supports the abstraction and its reported implementation, with its editorial-note status preserved. Berkeley supplies identity and dated institutional context. The 2017 author republication is retrospective, not evidence of a fresh deployment. Ben Pfaff's 2025 USENIX interview provides participant recollection of the commercial setting. The organisational implications below are editorial deductions, not measured savings.