ng thus formulated the problem, we can leverage the seminal work of Dana Angluin in developing a polynomial-time algorithm for learning a DFA by adaptively injecting test queries to infer the hidden states and transitions [73]. Specifically, the NF (with a given configu- ration) is the DFA to be inferred and we adaptively generate test traffic to exercise the NF's (unknown) state space. While active learning via Angluin's algorithm is a good starting point, there are key domain-specific challenges that arise in applying it for NF model synthesis. The first challenge relates to the complex configurations of NFs that can have a large number of rules of varying types. However, Angluin's algorithm can only learn a model for a con- crete instance and it is fundamentally infeasible to exhaustively run it for every possible configuration instance. Thus, we need ways to gen- erate extensible models for arbitrary configurations. Second, even for a given configuration command, the space of possible packet sequences and packet-header combinations can be prohibitively large. Finally, NF actions can be complex and diverse; for example, the behavior of differ- ent NFs may depend on specific header fields or manifest at different granularities of traffic aggregation (e.g., packet vs flow VS connection), and NFs may modify traffic to complicate model inference. We view a whole NF instance as a black box and probe its internal logic by sending packets/requests to it and observing its reactions. We build a system that takes the packet space (filtered by related header fields) as input, interacts with the black box NF, and leverage an active learning algorithm proposed by Dana Angluin to generate 3.5 NF Modeling a DFA model. The main idea of Angluin's algorithm is to iteratively assume a DFA model, compare the DFA with the NF, and refine the DFA until no difference is found between the DFA and the NF. Alembic has limitations on completeness (constrained by the learning algorithm), but it is suitable for the scenarios where NF sourc