Most openflow controllers in their default setup are in reactive mode. The thesis of the paper is that the probability of an admin keeping the default setup is quite high (as it is for operating systems for example) and hence proposes a few techniques to reveal the controller. The logic is similar to that of nmap, no technique is individually sufficient, but combining all the techniques gives a good intuition about the controller