Network verification

1. A network verification method, comprising:

identifying a data plane for routing traffic through a network that includes one or more forwarding tables for each switch of a plurality of switches in the data plane;

obtaining a forwarding behavior representation of the data plane based on the forwarding tables;

obtaining a forwarding rule from the one or more forwarding tables after obtaining the forwarding behavior representation;

transforming the forwarding behavior representation based on the forwarding rule by modifying a portion of the forwarding behavior representation affected by the forwarding rule without generating an entirely new representation;

pruning meta-information about the forwarding rule that is redundant to forwarding behavior; and

comparing the forwarding behavior representation of the data plane to one or more network properties of expected behavior of the data plane to detect one or more errors in the data plane as variations from the expected behavior.

2. The method of claim 1 , wherein obtaining a forwarding behavior representation of the data plane includes:

obtaining one or more forwarding rules from the forwarding tables; and

generating the forwarding behavior representation based on the one or more forwarding rules.

3. The method of claim 2 , wherein generating the forwarding behavior representation includes storing a set of beginning address values for the one or more forwarding rules and an associated priority-ordered list of forwarding rules associated with each of the beginning address values.

4. The method of claim 3 , wherein transforming the forwarding behavior representation includes:

determining whether an address range associated with the forwarding rule matches an existing atom;

generating additional atoms until the address range associated with the forwarding rule is completely covered by pre-existing atoms, the additional atoms, or both; and

updating ownership information of one or more atoms based on the forwarding rule and the additional atoms.

5. The method of claim 1 , wherein transforming the forwarding behavior representation includes storing ownership information of an atom, the atom including a numerical range of network addresses, and the ownership information of the atom being indicative of a given forwarding rule designated as an owner of the atom, the given forwarding rule being designated as the owner of the atom based on the given forwarding rule being a highest priority forwarding rule for the atom governing forwarding behavior with respect to the numerical range of network addresses of the atom for a given switch.

6. The method of claim 5 , wherein pruning meta-information includes pruning other potential owning rules with a lower priority than the given forwarding rule identified in the ownership information.

7. The method of claim 1 , further comprising:

removing a second forwarding rule from the forwarding behavior representation; and

reconstructing particular meta-information associated with the second forwarding rule to determine additional forwarding behavior modifications based on removal of the second forwarding rule.

8. The method of claim 7 , wherein reconstructing the particular meta-information includes determining new ownership information of one or more atoms affected by the second forwarding rule, the new ownership information includes a next highest priority rule after the second forwarding rule.

9. The method of claim 8 , wherein the forwarding rule affects an Internet Protocol (IP) prefix.

10. The method of claim 1 , wherein transforming the forwarding behavior representation of the data plane comprises generating an edge-labelled graph, wherein each edge of the edge-labelled graph is associated with one or more atoms, each atom representing a distinct address range and the forwarding rule is associated with one or more atoms covering a range of addresses affected by a given forwarding rule.

11. One or more non-transitory computer-readable media that include instructions that, in response to being executed by one or more processors, are configured to cause a system to perform operations, the operations comprising:

identifying a data plane for routing traffic through a network that includes one or more forwarding tables for each switch of a plurality of switches in the data plane;

obtaining a forwarding behavior representation of the data plane based on the forwarding tables;

obtaining a forwarding rule from the one or more forwarding tables after obtaining the forwarding behavior representation;

transforming the forwarding behavior representation based on the forwarding rule by modifying a portion of the forwarding behavior representation affected by the forwarding rule without generating an entirely new representation;

pruning meta-information about the forwarding rule that is redundant to forwarding behavior; and

comparing the forwarding behavior representation of the data plane to one or more network properties of expected behavior of the data plane to detect one or more errors in the data plane as variations from the expected behavior.

12. The computer-readable media of claim 11 , wherein obtaining a forwarding behavior representation of the data plane includes:

obtaining one or more forwarding rules from the forwarding tables; and

generating the forwarding behavior representation based on the one or more forwarding rules.

13. The computer-readable media of claim 12 , wherein generating the forwarding behavior representation includes storing a set of beginning address values for the one or more forwarding rules and an associated priority-ordered list of forwarding rules associated with each of the beginning address values.

14. The computer-readable media of claim 11 , wherein transforming the forwarding behavior representation includes storing ownership information of an atom, the atom including a numerical range of network addresses, and the ownership information of the atom being indicative of a given forwarding rule designated as an owner of the atom, the given forwarding rule being designated as the owner of the atom based on the given forwarding rule being a highest priority forwarding rule for the atom governing forwarding behavior with respect to the numerical range of network addresses of the atom for a given switch.

15. The computer-readable media of claim 14 , wherein pruning meta-information includes pruning other potential owning rules with a lower priority than the given forwarding rule identified in the ownership information.

16. The computer-readable media of claim 11 , transforming the forwarding behavior representation includes additional operations comprising:

determining whether an address range associated with the forwarding rule matches an existing atom;

generating additional atoms until the address range associated with the forwarding rule is completely covered by pre-existing atoms, the additional atoms, or both; and

updating ownership information of one or more atoms based on the forwarding rule and the additional atoms.

17. The computer-readable media of claim 11 , the operations further comprising

removing a second forwarding rule from the forwarding behavior representation; and

reconstructing particular meta-information associated with the second forwarding rule to determine additional forwarding behavior modifications based on removal of the second forwarding rule.

18. The computer-readable media of claim 17 , wherein reconstructing the particular meta-information includes determining new ownership information of one or more atoms affected by the second forwarding rule, the new ownership information includes a next highest priority rule after the second forwarding rule.

19. A network verification system, comprising:

one or more processors; and

one or more non-transitory computer-readable media that include instructions that, when executed by the one or more processors, are configured to cause the network verification system to perform operations, the operations comprising:

identifying a data plane for routing traffic through a network that includes one or more forwarding tables for each switch of a plurality of switches in the data plane;

obtaining a forwarding behavior representation of the data plane based on the forwarding tables;

obtaining a forwarding rule from the one or more forwarding tables after obtaining the forwarding behavior representation;

transforming the forwarding behavior representation based on the forwarding rule by modifying a portion of the forwarding behavior representation affected by the forwarding rule without generating an entirely new representation;

pruning meta-information about the forwarding rule that is redundant to forwarding behavior; and

comparing the forwarding behavior representation of the data plane to one or more network properties of expected behavior of the data plane to detect one or more errors in the data plane as variations from the expected behavior.

20. The system of claim 19 , wherein transforming the forwarding behavior representation includes storing ownership information of an atom, the atom including a numerical range of network addresses, and the ownership information of the atom being indicative of a given forwarding rule designated as an owner of the atom, the given forwarding rule being designated as the owner of the atom based on the given forwarding rule being a highest priority forwarding rule for the atom governing forwarding behavior with respect to the numerical range of network addresses of the atom for a given switch.