Programmable data planes and the P4 language

From fixed-function to programmable

Most switch chips are fixed-function: the vendor decides which headers they understand and what they can do. If you need support for a new protocol, you wait for new hardware. SDN with OpenFlow moved the decisions to a controller, but the switch still only understood a fixed list of header fields. A programmable data plane goes one step further: the forwarding behaviour itself is software. P4 (Programming Protocol-independent Packet Processors) is the open language most widely used to describe that behaviour. It is maintained as an open-source project hosted by the Linux Foundation.

How a P4 program is structured

P4 targets a model often called PISA (Protocol Independent Switch Architecture). A program defines:

• Headers: the layout of each header you care about, such as Ethernet, IPv4 or a custom tag.
• Parser: a small state machine that reads the packet and extracts those headers.
• Match-action tables: each table matches on fields (exact, longest prefix or ternary) and runs an action such as forward, drop, rewrite or count.
• Control blocks: the order in which tables are applied in ingress and egress.
• Deparser: puts the possibly modified headers back on the packet.

A simplified IPv4 forwarding table in P4_16 looks like this:

table ipv4_lpm {
    key = { hdr.ipv4.dstAddr : lpm; }
    actions = { ipv4_forward; drop; }
    size = 1024;
    default_action = drop();
}

The program defines the table; the entries (which prefixes go where) are added at runtime by a controller through P4Runtime, a gRPC-based API. So P4 still fits the SDN model, with a cleaner split between what the switch can do and what it is told to do.

P4 compared with OpenFlow

The two can work together: you could write a P4 program that behaves like an OpenFlow switch. P4 targets include the open-source BMv2 software switch for learning, some SmartNICs and Data Processing Units (DPUs), and FPGAs. The market for programmable switch chips has changed over time, so check current vendor support before planning a production design.

Uses in operations and security

• In-band Network Telemetry (INT): switches add queue depth and timing data to packets as they pass, giving per-packet visibility that sampling tools miss.
• Line-rate filtering: drop traffic that matches an attack signature, or rate-limit a source, without sending packets to a server.
• DDoS detection: count flows in data plane registers and flag sudden spikes.
• Custom protocols: research and cloud providers use P4 to test new encapsulations and load balancing ideas.

Programmable data planes also bring new risks. A bug in the P4 program can mis-forward or leak traffic, so programs need code review, testing and version control just like any other software. P4Runtime access must be authenticated and encrypted, because it can rewrite every table.

Tip: to learn P4 safely, use the official P4 tutorials with BMv2 and Mininet in a virtual machine. Everything runs in software on your own laptop.