not protected against its immediate upstream node (S2) failure. Because the backup path (S4, S5, S2, controller) will pass through S2. Switch S6 is protected against both its outgoing link and its immedi- ate upstream node failures: If link (S6,S3) or node S3 fails, the control traffic of S3 will be sent over link (S6,S5) and it will not pass through node S3. Depending on how critical or frequent link failures are versus node failures in the network, the network operator could assign different costs to these two kinds of failures, for example, cost a for node failure and cost B for link failure. For example, a = could be interpreted and used for scenarios where link and node failures are equally likely - or when it is equally important to protect the network against both kinds of failures. This way, the cost of not having protection at a node could be evaluated at a + B if the node is not protected at all, at a if it is pro- tected only against its outgoing link failure, and at zero if it is protected against the upstream node failure as well. For those switches directly connected to the controller, the upstream node protection cannot be defined (as the immediate upstream node is the controller). For those nodes, therefore, the assigned cost is zero if they are protected against their outgoing link failure and is a + B otherwise. 4.4.4.3 Downstream Versus Upstream Nodes In this work, we assume that the traditional failure management tools are deployed in the split-architecture network, that is, there is no extended signaling mechanism for a node to inform its downstream nodes of a failure. Therefore, if a switch is disconnected from the controller (i.e., if there is no backup path programmed in the switch), then all its downstream nodes will also be disconnected, even if they are themselves locally protected against their outgoing links or immediate upstream nodes failures. This means that in evaluating networks resiliency, more weights should be assigned to nodes closer to the controller (which is the root of th