e controller routing tree). More precisely, the weight of each node should also be proportional to the number of its downstream nodes. In Figure 4.14, for example, failure of the link between S2 and the controller results in the disconnection of all S, S2, S4, and S5 from the 4 Software-Defined Networks Principles and Applications controller. This failure costs four times more compared to when the link (S, S2) fails, which only disconnects S1 from the controller. Implementation of protection using OpenFlow Our proposal can be applied to any implementation of the split archi- tecture. The forwarding table in an OpenFlow switch, for example, is populated with entries consisting of a rule defining matches for fields in packet headers, a set of actions associated with the flow match, and a collection of statistics on the flow. The OpenFlow specification version 1.1 introduces a method for allowing a single flow-match trig- ger forwarding on more than one port of the switch. Fast failover is one of such methods. Using this method, the switch executes the first, that is, live action set. Each action set is associated with a special port that controls its liveliness. OpenFlow's fast failover method enables the switch to change forwarding without requiring a round trip to the controller. 4.5 SDN Security Attack Prevention Network attacks have long been an important problem and have attracted a lot of research in academic and commercial sector. With a rapidly growing number of critical as well as business applications deployed on the Internet today, network attacks have both become more lucrative for the attackers and more damaging to the victims. The implications of network attacks on the victim can be huge. For example, a distributed denial-of-service (DDoS) can overwhelm the victim and make it unable to handle its regular business. A large- volume DDoS attack can further cause collateral damage to traffic that shares links with the victim's traffic, leading to large traffic drops, BGP session interruptions, and routing