ecurity and Solutions SDN DEVICES An SDN device is composed of an API for communication with the controller, an abstraction layer, and a packet-processing function. In the case of a virtual switch, this packet-processing function is packet-processing software, and in the case of a physical switch, the packet processing function is embodied in the hardware for packet-processing logic, The packet-processing logic consists of the mechanisms to take actions based on the results of evaluating incoming packets and finding the highest-priority match. When a match is found, the incoming packet is processed locally unless it is explicitly forwarded to the controller. When no match is found, the packet may be copied to the controller for further processing. This process is also referred to as the controller consuming the packet. In the case of a hardware switch, these mechanisms are implemented by the specialized hardware In the case of a software switch (virtual switches), these same functions are mirrored by software. Since the case of the software switch is somewhat simpler than the hardware switch. FLOW TABLES Flow tables consist of a number of prioritized flow entries, each of which typically consists of two components: match fields and actions. Match fields are used to compare against incoming packets. An incoming packet is compared against the match fields in priority order, and the first complete match is selected. Actions are the instructions that the network device should perform if an incoming packet matches the match fields specified for that flow entry. Match fields can have wildcards for fields that are not relevant to a particular match. For example, when matching packets based just on IP address or subnet, all other fields would be wild carded. Similarly, if matching on only MAC address or UDP/TCP port, the other fields are irrelevant, and consequently those fields are wild carded. Depending on the application needs, all fields may be important, in which case there would be no wildcards. The flow table and 