Formal verification of network changes

1. A method comprising:

generating a first model of a network comprising a first set of one or more rule tables, wherein the network comprises a plurality of network elements that forwards packets based on rule tables;

generating a second model of the network comprising a second set of one or more rule tables, wherein each rule table is described by one or more flow nodes, each flow node specifying a set of packets and an action to be taken on the specified set of packets;

determining a set of differential flow nodes for the second model based on the flow nodes of the first model and the flow nodes of the second model; and

verifying a network change based on the determined differential flow nodes;

wherein determining the set of differential flow nodes comprises:

identifying a first flow node in the first model that specifies a particular action for a first set of packets; and

identifying a second, corresponding flow node in the second model that specifies the particular action for a second set of packets;

creating a first differential flow node that specifies the particular action for an intersection between the first and second sets of packets;

creating a second differential flow node that specifies the particular action for packets that are in the first set of packets but not in the second set of packets; and

creating a third differential flow node that specifies the particular action for packets that are in the second set of packets but not in the first set of packets.

2. The method of claim 1 , wherein the verification of the network change is further based on a specified intent for a modification of the network, wherein the first model is constructed based on data captured from the network before the modification and the second model is constructed based on data captured from the network after the modification.

3. The method of claim 1 , wherein each differential flow node specifies a set of packets and an action to be taken on the specified set of packets and is associated with a rule table in the first model or the second model.

4. The method of claim 1 , wherein each differential flow node is classified as being one of (i) newly removed, (ii) newly added, and (iii) unaffected.

5. The method of claim 4 , further comprising:

identifying paths through the network by traversing the differential flow nodes; and

verifying the network change based on differential flow nodes that are traversed by the identified paths.

6. The method of claim 4 , wherein verifying the network change comprises checking paths with differential flow nodes that are classified as newly removed or newly added against a specified intent of the network.

7. The method of claim 1 , wherein identifying a path comprises (i) identifying a differential flow node for a set of packets at a first rule table and (ii) following an action specified by the differential flow node to a second rule table.

8. The method of claim 1 , wherein when the particular action is not performed for the first set of packets at the first flow node of the first model, the first and second differential flow nodes are not created.

9. The method of claim 1 , wherein when the particular action is not performed for the second set of packets at the second flow node of the second model, the first and third different flow nodes are not created.

10. The method of claim 1 , further comprising:

classifying the first differential flow node as being unaffected;

classifying the second differential flow node as being newly removed; and

classifying the third differential flow node as being newly added.

11. The method of claim 1 , wherein determining the set of differential flow nodes further comprises:

identifying a first flow node in the first model that specifies first and second actions for a particular set of packets;

identifying a second, corresponding flow node in the second model that specifies first and third actions for the particular set of packets;

creating a first differential flow node that specifies the first action for the particular set of packets and no other actions;

creating a second differential flow node that specifies the second action for the particular set of packets and no other actions; and

creating a third differential flow node that specifies the third action for the particular set of packets and no other actions.

12. The method of claim 11 , further comprising:

classifying the first differential flow node as being unaffected;

classifying the second differential flow node as being newly removed; and

classifying the third differential flow node as being newly added.

13. The method of claim 1 , wherein the plurality of forwarding elements comprises a plurality of routers.

14. The method of claim 1 , wherein the plurality of forwarding elements comprises a plurality of switches.

15. A computing device comprising:

one or more processors; and

a computer-readable storage medium storing a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising:

generating a first model of a network comprising a first set of one or more rule tables;

generating a second model of the network comprising a second set of one or more rule tables, wherein each rule table is described by one or more flow nodes, each flow node specifying a set of packets and an action to be taken on the specified set of packets;

determining a set of differential flow nodes for the second model based on the flow nodes of the first model and the flow nodes of the second model; and

verifying a network change based on the determined differential flow nodes;

wherein determining the set of differential flow nodes comprises:

identifying a first flow node in the first model that specifies a particular action for a first set of packets;

identifying a second, corresponding flow node in the second model that specifies the particular action for a second set of packets;

creating a first differential flow node that specifies the particular action for an intersection between the first and second sets of packets;

creating a second differential flow node that specifies the particular action for packets that are in the first set of packets but not in the second set of packets; and

creating a third differential flow node that specifies the particular action for packets that are in the second set of packets but not in the first set of packets.

16. The computing device of claim 15 , wherein the verification of the network change is further based on a specified intent for a modification of the network, wherein the first model is constructed based on data captured from the network before the modification and the second model is constructed based on data captured from the network after the modification.

17. The computing device of claim 15 , wherein each differential flow node specifies a set of packets and an action to be taken on the specified set of packets and is associated with a rule table in the first model or the second model.

18. The computing device of claim 15 , wherein each differential flow node is classified as being one of (i) newly removed, (ii) newly added, and (iii) unaffected.

19. The computing device of claim 18 , further comprising:

identifying paths through the network by traversing the differential flow nodes; and

verifying the network change based on differential flow nodes that are traversed by the identified paths by checking paths with differential flow nodes that are classified as newly removed or newly added against a specified intent of the network.

20. The computing device of claim 15 , wherein identifying a path comprises (i) identifying a differential flow node for a set of packets at a first rule table and (ii) following an action specified by the differential flow node to a second rule table.

21. A non-transitory machine-readable medium storing a program for execution by at least one hardware processing unit, the program comprising sets of instructions for:

generating a first model of a network comprising a first set of one or more rule tables;

generating a second model of the network comprising a second set of one or more rule tables, wherein each rule table is described by one or more flow nodes, each flow node specifying a set of packets and an action to be taken on the specified set of packets;

determining a set of differential flow nodes for the second model based on the flow nodes of the first model and the flow nodes of the second model; and

verifying a network change based on the determined differential flow nodes;

wherein determining the set of differential flow nodes comprises:

identifying a first flow node in the first model that specifies a particular action for

a first set of packets;

identifying a second, corresponding flow node in the second model that specifies the particular action for a second set of packets;

creating a first differential flow node that specifies the particular action for an intersection between the first and second sets of packets;

creating a second differential flow node that specifies the particular action for packets that are in the first set of packets but not in the second set of packets; and

creating a third differential flow node that specifies the particular action for packets that are in the second set of packets but not in the first set of packets.