ead, we can take a distributed approach. Each switch is responsible for checkpointing its own state. For rollback recovery, some coordination between the controller and the switches can be used to select a network-wide consistent set of previously collected checkpoints and roll each switch back to the checkpoint selected for that switch. Second, controller checkpoint is similar to checkpoint of any type of user-level process. That is, a checkpoint of the controller includes the controller process's address space and the state of its registers. For recovery, the new process is spawned, which initializes its address space from the checkpoint file and resets its registers. It is achieved by adding a piece of code, called checkpointer, being compiled or linked with the controller transparently. 4.4.4 Controller Placement In evaluating a network design, the network resilience is an important factor, as a failure of a few milliseconds may easily result in terabyte data losses on high-speed links. In traditional networks, where both control and data packets are transmitted on the same link, the con- trol and data information are equally affected when a failure happens. The existing work on the network resilience analysis have therefore assumed an in-band control model, meaning that the control plane and data plane have the same resilience properties. However, this model is not applicable to split-architecture networks. On one hand, the control packets in split-architecture networks can be transmitted on different 4.4 SDN Management Switch Controller checkpoint checkpoint coordinator SDN controller Figure 4.10 SDN checkpoint system. paths from the data packet (or even on a separate network). Therefore, the reliability of the control plane in these networks is no longer linked with that of the forwarding plane. On the other hand, disconnection between controller and the forwarding planes in the split architec- ture could disable the forwarding plane: when a switch is disconnected from its control plane, it cannot receive 