Run the rebuffer through these layers. The campus NOC’s measurement was the SNMP counter, averaged over 5 minutes. Which layer lost the burst?

In 1994, Leland-Taqqu-Willinger-Wilson at Bellcore traced a year of real Ethernet traffic and found:

Traffic is bursty at every timescale they could observe — milliseconds, seconds, minutes, hours.

Zoom in. Zoom out. Same shape. They named it self-similarity.

Aggregating does not smooth. The Poisson model — basis of decades of queueing theory inherited from telephony — was empirically wrong.

Consequences for measurement:

• Averaging at any timescale hides bursts at every smaller timescale.
• Uniform sampling under-represents heavy tails (a few flows carry most bytes).
• Periodic polling aliases with periodic phenomena.

Take a minute. Where in the table can the human still be the decider?

Human reaction is at the bottom of the slow end. Not because of laziness. Because of physics.

If the human is not in the loop, who is? That’s the next invariant.

There are three steps of authority over the loop. For each one, think: who has the password? what’s the scope of their decisions?

Stop. Predict each one before clicking.

So who’s at the receiving end of all this authority? What does the operator actually see?

For 40 years, that consumer has been a single human operator. What does that look like concretely? Predict before you click.

Three examples each. Walk through your day on an on-call shift.

Most of what operations tooling is, is a workaround for what a single human can absorb and act on.

That gap shows up everywhere: aggregated counters, thresholded alerts, 5-minute polling cadences, dashboards as the universal interface.

If the consumer contract has shaped four decades of tools, what was the first version?

Why 5 minutes? Not a network constraint — a consumer constraint. Faster polls would have produced more data than the human in the loop could absorb.

So operators ran on 5-min averages. They suspected they were missing things, but they had no way to prove it.

By 1994 they had proof: Leland-Taqqu-Willinger-Wilson’s self-similarity result (we saw this on slide 13) showed traffic was bursty at every timescale — meaning the 5-min averages had been systematically lying about what the network was doing.

Knowing the era’s tooling was lying didn’t give operators anything better to deploy. What came next?

sFlow (sampling). IPFIX (standardization). Paxson NPD (1997) — active probing methodology, with careful attention to sampling bias.

Better measurement → better diagnostics. Operators could see what was wrong in finer detail.

But control was still distributed by design. Every router ran its own BGP, OSPF, scheduling decisions independently. Even with config-management automation, operators were tweaking inputs to distributed algorithms — they could not centrally express what the network as a whole should do.

The next gap wasn’t seeing. It was being able to express network-wide intent.

In 2003, Clark, Partridge, Ramming, and Wroclawski named the missing layer.

A new plane — alongside the data plane (forwards packets) and the control plane (computes routes) — whose job is to:

1. Maintain an explicit belief about what the network is supposed to do.
2. Distinguish raw observations (telemetry, counters) from interpreted beliefs (what those observations mean).
3. Reason about uncertainty — missing data, conflicting evidence, hidden state.
4. Provide services and advice to the data + control planes that consume the belief.

The Knowledge Plane was not an architecture or a controller — it was the abstraction that named what operations needed but did not yet have.

Operations is what you do when sensing has produced a belief and a decision must follow. The Knowledge Plane named the belief.

The vision named the missing layer. Who built it?

You already know three examples of this from earlier in the course. Name them before clicking.

• BGP — every router computes its own best path from neighbor announcements.
• OSPF — every router floods link-state, runs Dijkstra independently.
• TCP congestion control — every endpoint, its own algorithm.

What’s hard about this regime?

Hard to express network-wide intent. Hard to query global state. No router holds the whole picture.

1. Match-action tables in every switch — (match this header pattern → take this action).
2. OpenFlow protocol — controller installs rules into switches and queries them.
3. Centralized controller — runs one program over a global picture.

Per-rule counters → centralized observability. Per-rule install → centralized control.

Same abstraction. Both observation and action.

Before clicking: what kinds of new control actions would centralization enable that distributed protocols could not? (Hint: think about what BGP cannot express, or what TE looks like when one program sees every link in your WAN.)

Pattern: the centralization paid off because it let operators express things distributed protocols structurally could not.

Huston (APNIC 2025): ISP-scale SDN has “essential operational fragility” — controller trusts local state stays constant; often it doesn’t.

Hyperscalers adopt first. The rest of the Internet trails by years to decades.

Observability (counters → flow records → probes) Belief (Knowledge Plane named it; SDN built the prerequisite) Programmable authority (SDN controllers with concrete TE / peering / load-balancing actions)

But:

• The consumer was still a human.
• The data plane was still mostly fixed-function.
• The Interface contract had not yet shifted.

Thursday: the data-plane revolution. Pre-read: Clark Knowledge Plane 2003.