program analysis techniques (e.g., program slicing, system dependency analysis) to identify them. These features are listed as follows: Persistent: The variable has a lifetime longer than the packet processing loop. Top level: The variable is actually used during packet processing. Updateable: The variable's value is updated during packet process- ing, that is, usually an LHS variable. Output-impacting: The variable impact variables in the packet out- put function. These features and categorization of variables are used for code anal- ysis to generate the NF models. 3.5.1.2 Modeling Example We use a Layer-4 load balancer as an example of the NF source code and illustrate how the above techniques can be used to synthesize 3 Network Function Virtualization 1 from scapy all import 2 # Constants 3 ROUND_ROBIN = 1 4 MTU = 1500 5 # Configurations 6 mode = ROUND_ROBIN 7 LB_IFACE = "eth0" 8 LB_IP, LB_PORT = 3.3.3.3", 80 9 servers=[("1.1.1.1" 80), "2.2.2.2", 80)] 10 # Output-Impacting States 11 f2b_nat, b2f_nat={}, {} 12 rr_idx = 0 13 cur_port = 10000 14 # Log States 15 pass_stat, drop_stat=0, 16 # callback function 17 def pkt_callback(pkt): global drop_stat, pass_stat rr_idx, cur_port si, di = pkt [IP] src, pkt[IP].dst sp, dp = pkt [TCP].sport, pkt [TCP]. dport if dp = LB_PORT: # pkt from client to server cs_ftpl , sc_ftpl = (si sp, di,dp), (di,dp, si,sp) if cs_ftpl not in f2b_nat: # new connection if mode = ROUND_ROBIN: server = servers [rr_idx] rr_idx = (rr_idx+1) % len (servers) else: # Hash to a backend server server = servers [hash(si) % len (servers) n-port = cur_port cur_port+=1 cs_btpl = (LB_IP, n-port, server [0], server [1]) sc_btpl = (server [0], server[1], LB_IP, n_port) f2b_nat [cs_ftpl], b2f_nat [sc_btpl]=cs_btpl,sc_ftpl nat_tpl = cs_btpl else: # existing connection nat_tpl = f2b_nat[cs_ftpl] else: # pkt from server to client sc_btpl = (si, sp, di, dp) if sc_btpl in b2f_nat: nat_tpl = b2f_nat [sc_btpl] else: # no initial outbound traffic is allowed drop_stat+=1 return pass_stat+=1 pkt [IP].src, pkt [TCP].sp