Software-defined networking (SDN) makes the separation between control logic and packet forwarding explicit and programmable.

Instead of requiring every forwarding device to run all control logic independently, an SDN controller can maintain a broader network view and install match-action rules in switches. A rule conceptually says: if selected header fields match some pattern, forward, drop, modify or redirect the packet according to an action.

For example, a controller could install rules that steer one traffic class through a firewall while forwarding another directly.

A logically centralized controller need not be one physical machine; robust implementations can distribute controller state while presenting a coherent control abstraction.

SDN's reusable idea is not one protocol or product. It is programmable control over forwarding behavior through a well-defined interface between control plane and data plane.