Verifying large-scale networks using NetCheck

Abstract

We present NetCheck, a network policy language for verifying large-scale networked infrastructures. NetCheck is expressive enough to capture basic network properties such as reachability and maintenance, as well as more complex behaviours such as end-to-end connectivity, traffic isolation or tunnel invariance. NetCheck is fully-automated, and does not require any intervention on the network under scrutiny. It is deployed on an automatically-generated model of the network data plane, expressed in the SEFL language. NetCheck relies on symbolic execution for exploring all feasible paths through the network.