Software-Defined Networking Interview Questions and Answers

Core Concepts: Control Plane vs. Data Plane

In SDN, the control plane, the logic that decides where traffic should go, moves off individual switches and into a centralized controller, while the data plane, the actual packet forwarding, stays on the switches themselves. The architecture is usually described in three layers: an application layer where network services and policies get defined, a control layer where the SDN controller lives, and an infrastructure layer of switches that just forward packets on instruction.

The controller talks upward to applications through a northbound API, most commonly a REST interface, and downward to switches through a southbound API, most commonly OpenFlow. OpenFlow has allowed a switch to maintain connections to more than one controller at once since version 1.2, published in February 2012 by the Open Networking Foundation, which is the feature that makes every multi-controller resilience pattern later in this guide possible.

What’s the difference between SDN and NFV?
SDN centralizes the control plane for a network’s switches and routers. NFV replaces dedicated hardware appliances, firewalls and load balancers among them, with software running on standard servers. A network can use NFV without SDN and SDN without NFV, though most modern carrier deployments combine both.

OpenFlow: The Protocol Behind Every SDN Interview Question

OpenFlow is the southbound protocol that lets a controller add, modify, and delete entries in a switch’s flow table. The version an interviewer expects you to know is 1.3, the version most production Open SDN deployments and open-source switches still target, even though the published specification has moved further.

Open vSwitch, the software switch behind most SDN testbeds and a large share of production deployments, lists its OpenFlow 1.0 through 1.2 support as complete but flags 1.3 support as requiring additional work beyond that baseline, according to the Open vSwitch project documentation. That gap between the published spec and what the most-used software switch actually implements is the practical reason 1.3 fluency is treated as sufficient in an interview and 1.5 knowledge as a bonus.

A Cisco Catalyst 2960-X switch configured for OpenFlow makes the scarcity concrete: per Cisco’s configuration guide, the platform supports at most 500 Layer 3 flow entries across a maximum of 48 OpenFlow-enabled ports, accepts new flow programming from the controller at a sustained rate of no more than 50 flows per second, and does the matching in software instead of a hardware TCAM, because of ASIC limitations on that platform.

Which OpenFlow version should I say I know in an interview?
1.3. It’s the version most vendors implement and most open-source stacks target. Naming 1.5 features, egress tables and packet-type-aware pipelines among them, as a bonus signals depth without overclaiming what’s actually deployed.

Controllers: OpenDaylight, ONOS, Ryu, and Floodlight

OpenDaylight and ONOS are the two controllers interviewers ask about most. The functional difference between them is their consistency model: OpenDaylight elects a single leader per cluster for high availability, while ONOS keeps an eventually-consistent distributed store shared across every instance.

OpenDaylight’s current named release, Vanadium SR1, shipped April 22, 2026 on Java 21, per the OpenDaylight project. ONOS reached its 24th release, 2.7.0, in a lineage stretching back to its December 2014 debut, with the codebase growing from roughly 50,000 lines of code to over 500,000, according to the Open Networking Foundation’s release notes. Per Aptira’s controller review, OpenDaylight carries the largest open-source community of the group; its companion ONOS review notes ONOS’s intent-based framework and native multi-site routing support. Floodlight, meanwhile, is the only one of the four still commonly paired with the full OpenFlow 1.0 through 1.4 range, per an arXiv systematic literature review of NFV and SDN architectures.

The choice mostly comes down to two questions: does the team already run Java-based network infrastructure, and does the deployment need carrier-scale distributed consistency or a single, simpler point of control.

If your SDN controller goes down, what happens to existing traffic flows?
Already-installed flow entries keep forwarding traffic on the switches, since the data plane doesn’t depend on an active controller connection for packets that already match a rule. What breaks is anything needing a new decision: unmatched packets that would normally reach the controller instead get dropped or handled by whatever table-miss behavior was configured, which is why production deployments run multiple controller instances instead of one.

Security and Failure Modes: Beyond the Generic List

A strong security answer names a concrete way an attacker exploits the controller’s centralization, such as a flow-table exhaustion attack against the switch’s TCAM, instead of only listing centralization as a generic risk. Hardware OpenFlow switches store flow entries in ternary content-addressable memory for fast lookups, and TCAM’s cost and power draw mean commercial switches typically cap out at a few hundred thousand entries, per research published in Security and Communication Networks.

Researchers demonstrated a Slow-TCAM attack that denies service to legitimate traffic in as little as 38 seconds while sending fewer than 40 packets per second, specifically because it stays under the volume-based triggers that catch conventional flooding attacks, according to the peer-reviewed study “Disrupting SDN via the Data Plane”. The standard mitigation is rate-limiting flow installation with a token bucket, the same class of control the Cisco Catalyst platform above already enforces at 50 flows per second.

How would you defend against a flow-table exhaustion attack on an OpenFlow switch?
Rate-limit how fast the controller installs new flow entries, use short idle timeouts so stale entries clear quickly, and monitor flow-table occupancy directly instead of relying on traffic-volume alarms, since slow exhaustion attacks are built to stay under volume-based thresholds.

SDN vs. NFV vs. SD-WAN

These three terms describe different layers of the same shift and get confused constantly in interviews: SDN decouples control from forwarding inside a network, NFV replaces dedicated appliances with software, and SD-WAN is an SDN application aimed specifically at wide-area links.

The three are complementary rather than competing, so an interviewer asking you to distinguish them is testing whether you can place a specific deployment in the right layer, not whether you can recite three separate definitions.

What a Rushed SDN Rollout Usually Gets Wrong

The most common failure mode in production SDN rollouts is centralizing control over a network that never needed it in the first place: a 50-switch branch network gains little from a distributed controller cluster and instead inherits a new single point of failure with none of the carrier-scale benefit. The second common mistake is skipping controller redundancy during a pilot, then discovering during the first controller restart that every unmatched packet has nowhere to go. Neither mistake shows up in a proof-of-concept; both show up in the first unplanned outage.

The “Weeks to Minutes” Provisioning Claim: What the Record Shows

Designing a Fault-Tolerant Control Plane: A Worked Scenario

For a 500-switch data center, the design question is how many failure domains to plan controllers around, and which consistency model tolerates a lost instance without losing the whole cluster’s view of the network.

A workable answer: split the fabric into 3 to 5 controller clusters mapped to physical failure domains, per pod or per row, and run each cluster with an odd number of instances, 3 as the common baseline, so leader election or the consistency protocol keeps a majority after a single loss. Confirm that the chosen controller’s southbound stack supports the multiple-controller connections OpenFlow has allowed since version 1.2. This is also where the controller choice from the table above matters in practice: an eventually-consistent, cluster-oriented option like ONOS is built for exactly this kind of spread, and a leader-election model like OpenDaylight’s works too, provided the design accounts for what happens to switches whose leader instance sat in the failed domain until a new one is elected.