Control Plane vs Data Plane | The Ancient Soldier

you weren’t working networking long
before you hear someone talking about the control plane and the data plane at
first this can be quite confusing what are they what are they used for
what’s the difference between them we’re here to demystify the control and data
planes in times past communication was very manual think of an ancient general
organizing his troops he may post a soldier as a messenger this soldier
needs to listen closely for any messages or watch read signals and be prepared to
pass them on he’s not overly concerned with the message itself he just needs to
pass it on quickly and accurately but there are also times when the messages
are meant directly for him another soldier may be talking to him
maybe he’s getting new orders or maybe he’s finding out about a shift change
in this case our soldier cares about this message he needs to listen to
what’s being said think about it and then respond our networking devices are
like this soldier a major part of what they do is receive traffic and pass it
on quickly and accurately this is the data plane also known as the forwarding
plane this includes the FIB at layer 3 and switching at layer 2 routers and
switches will also make good use of technologies like saif t cam tables and
specialized Asics if they’re available but these devices also need to be able
to respond to traffic that’s sent to them and generate messages themselves
they need to participate in the conversation this kind of traffic could
include management routing protocols ping monitoring and so on this is
control plane traffic the control plane is special as it’s involved in
controlling how data is forwarded through the network think of routing
protocols for example the control plane can definitely affect the data plane
this includes altering and filtering data like load balancing firewall rules
and so on you can roughly think of the control plane as the brain of the
network but why do we bother making a distinction between the two one reason
is technologies can be developed independently you can take a router that you
bought a few years ago and installed new software on it giving you new features
the control plane features are not locked into the hardware of the data
plane as they can major advantage is seen in Software Defined Networking if
the data plane and control plane is separate we can remove the control plane
from the device and now we have a separate device such as an SDN
controller which manages how the network behaves our switches and routers can now
simply focus on forwarding only think of our soldier again for a moment imagine
if he gets too busy chatting to another soldier he could get easily distracted
or overwhelmed this may make it difficult to do his real job
he might even miss something important the same can happen in the network the
control plane utilizes the CPU regularly so if the CPU gets fully utilized the
control plane suffers if it gets too busy to handle any new packets it may
struggle with something critical like OSPF or EIGRP this in turn can cause a
problem for the data plane so as you can see the control plane is a potential
attack surface if an attacker can overwhelm the control plane perhaps with
a ping flood or some other DDoS attack they could compromise the whole device
this is why we can use control plane protection this is where we limit the
amount of certain types of control plane traffic that a device will accept some
devices will have basic protection built-in some more advanced platforms
will let you configure the protection yourself mostly through quads policies
there’s just one last thing I’d like to cover and that’s what is sometimes known
as the management plane the management plane is management traffic that’s going
to a device like ssh telnet web console SNMP and others strictly speaking this
is still control plane traffic but you can treat it differently to other types
of control plane traffic like routing updates NetFlow ping and so on this
raises an interesting question is all management traffic control plane traffic
well it depends on the perspective if management traffic is going to a device
then as far as this device is concerned this is control plane traffic if
management traffic is going through a device perhaps to manage another device
somewhere else then from the devices perspective this is data plane traffic
so the simplified version of all this is that when forwarding traffic were using
the data plane when generating or responding to traffic we’re using the
control plane hope all this makes sense and thank you for watching

Leave a Reply

Your email address will not be published. Required fields are marked *