What Is Service Function Chaining?

Service Function Chaining (SFC) is a networking technique that defines an ordered sequence of service functions through which traffic must pass on its way between a source and a destination. A service function is any component that inspects, modifies, or acts on network traffic: examples include firewalls, intrusion detection systems, deep packet inspection engines, network address translators, and WAN optimization appliances. Traditional networks assigned these functions to fixed hardware appliances at predetermined points in the network topology. SFC decouples the logical ordering of service functions from the physical infrastructure, allowing operators to define and reconfigure service paths in software without physically rerouting cables or reconfiguring appliances.

The architectural framework for SFC was standardized by the IETF in 2015. The IETF RFC 7665 on SFC Architecture defines the components, concepts, and principles governing how service chains are specified, created, and maintained within a single administrative domain. A companion document, RFC 7498, defines the problem statement that motivated the standard, and RFC 8300 specifies the Network Service Header (NSH) used to carry chain metadata through the data plane.

SFC Architecture and Standards

The SFC architecture separates concerns across three planes. The control plane manages the definition of service function chains, selecting which service functions a given traffic flow must traverse and in what order. The data plane forwards packets along the specified service path, using the NSH encapsulation to carry chain state, a service path identifier, and a service index that decrements as each function in the chain processes the packet. The management plane handles lifecycle operations: provisioning service functions, registering them with the SFC classifier, and monitoring performance along the chain.

Three architectural roles are defined by the standard: the SFC classifier, which matches incoming traffic to a service chain based on rules; the Service Function Forwarder (SFF), which steers packets to the correct service function and then forwards them to the next element in the chain; and the service function itself, which performs its inspection or transformation and returns the packet to the forwarder. This separation of forwarding from function processing is what allows chains to span heterogeneous hardware, virtual machines, and containers.

Implementation with NFV and SDN

SFC reaches its operational potential when combined with Network Function Virtualization (NFV) and Software-Defined Networking (SDN). NFV enables service functions to run as software on general-purpose servers rather than dedicated appliances, making functions instantiable on demand and scalable horizontally. SDN provides a programmable control layer that can update forwarding rules across network devices in real time, enabling dynamic reconfiguration of service paths as traffic patterns change or as service function instances are added or removed. As examined in research on SFC in 5G and beyond networks, the combination of NFV elasticity and SDN programmability is central to deploying SFC in mobile core networks where traffic profiles vary widely across services and time of day.

Orchestration platforms such as ETSI's Open Source MANO (OSM) and OpenStack Tacker manage the lifecycle of virtualized service functions and their chaining configurations, translating high-level service descriptors into data-plane forwarding state. An ACM study on SFC with SDN demonstrates how software-defined control of service function placement reduces operational complexity in multi-tenant environments.

Applications

Service function chaining has applications in a wide range of networking contexts, including:

• Carrier and enterprise networks applying security and policy functions to traffic flows without topology changes
• 5G mobile core networks steering user plane traffic through dynamically provisioned service chains
• Content delivery networks applying caching, transcoding, and rate-limiting functions in sequence
• Multi-tenant cloud environments enforcing tenant-specific security policies through virtualized function chains
• Industrial and enterprise IoT networks applying traffic inspection and filtering at the network edge