]>
Commit | Line | Data |
---|---|---|
a9b4a41a BP |
1 | .\" -*- nroff -*- |
2 | .de IQ | |
3 | . br | |
4 | . ns | |
5 | . IP "\\$1" | |
6 | .. | |
d2cb6c95 | 7 | .TH ovs\-ofctl 8 "@VERSION@" "Open vSwitch" "Open vSwitch Manual" |
064af421 | 8 | .ds PN ovs\-ofctl |
a9b4a41a | 9 | . |
064af421 BP |
10 | .SH NAME |
11 | ovs\-ofctl \- administer OpenFlow switches | |
a9b4a41a | 12 | . |
064af421 BP |
13 | .SH SYNOPSIS |
14 | .B ovs\-ofctl | |
15 | [\fIoptions\fR] \fIcommand \fR[\fIswitch\fR] [\fIargs\fR\&...] | |
a9b4a41a | 16 | . |
064af421 BP |
17 | .SH DESCRIPTION |
18 | The | |
19 | .B ovs\-ofctl | |
20 | program is a command line tool for monitoring and administering | |
21 | OpenFlow switches. It can also show the current state of an OpenFlow | |
22 | switch, including features, configuration, and table entries. | |
0d8e9638 | 23 | It should work with any OpenFlow switch, not just Open vSwitch. |
a9b4a41a | 24 | . |
064af421 | 25 | .SS "OpenFlow Switch Management Commands" |
a9b4a41a | 26 | .PP |
064af421 BP |
27 | These commands allow \fBovs\-ofctl\fR to monitor and administer an OpenFlow |
28 | switch. It is able to show the current state of a switch, including | |
29 | features, configuration, and table entries. | |
a9b4a41a | 30 | .PP |
064af421 BP |
31 | Most of these commands take an argument that specifies the method for |
32 | connecting to an OpenFlow switch. The following connection methods | |
33 | are supported: | |
a9b4a41a | 34 | . |
064af421 | 35 | .RS |
84ee7bcf BP |
36 | .so lib/vconn-active.man |
37 | . | |
064af421 BP |
38 | .IP "\fIfile\fR" |
39 | This is short for \fBunix:\fIfile\fR, as long as \fIfile\fR does not | |
40 | contain a colon. | |
84ee7bcf | 41 | . |
1a6f1e2a JG |
42 | .IP \fIbridge\fR |
43 | This is short for \fBunix:@RUNDIR@/\fIbridge\fB.mgmt\fR, as long as | |
44 | \fIbridge\fR does not contain a colon. | |
45 | . | |
46 | .IP [\fItype\fB@\fR]\fIdp\fR | |
47 | Attempts to look up the bridge associated with \fIdp\fR and open as | |
48 | above. If \fItype\fR is given, it specifies the datapath provider of | |
49 | \fIdp\fR, otherwise the default provider \fBsystem\fR is assumed. | |
064af421 | 50 | .RE |
a9b4a41a | 51 | . |
064af421 BP |
52 | .TP |
53 | \fBshow \fIswitch\fR | |
54 | Prints to the console information on \fIswitch\fR, including | |
55 | information on its flow tables and ports. | |
a9b4a41a | 56 | . |
064af421 | 57 | .TP |
4e312e69 | 58 | \fBdump\-tables \fIswitch\fR |
064af421 BP |
59 | Prints to the console statistics for each of the flow tables used by |
60 | \fIswitch\fR. | |
5deff5aa AW |
61 | .TP |
62 | \fBdump\-table\-features \fIswitch\fR | |
63 | Prints to the console features for each of the flow tables used by | |
64 | \fIswitch\fR. | |
03c72922 BP |
65 | .TP |
66 | \fBdump\-table\-desc \fIswitch\fR | |
67 | Prints to the console configuration for each of the flow tables used | |
68 | by \fIswitch\fR for OpenFlow 1.4+. | |
82c22d34 BP |
69 | .IP "\fBmod\-table \fIswitch\fR \fItable_id\fR \fIsetting\fR" |
70 | This command configures flow table settings for OpenFlow table | |
71 | \fItable_id\fR within \fIswitch\fR. The available settings depend on | |
72 | the OpenFlow version in use. In OpenFlow 1.1 and 1.2 (which must be | |
73 | enabled with the \fB\-O\fR option) only, \fBmod\-table\fR configures | |
74 | behavior when no flow is found when a packet is looked up in a flow | |
75 | table. The following \fIsetting\fR values are available: | |
c354fcc5 TG |
76 | .RS |
77 | .IP \fBdrop\fR | |
78 | Drop the packet. | |
79 | .IP \fBcontinue\fR | |
80 | Continue to the next table in the pipeline. (This is how an OpenFlow | |
81 | 1.0 switch always handles packets that do not match any flow, in | |
82 | tables other than the last one.) | |
83 | .IP \fBcontroller\fR | |
84 | Send to controller. (This is how an OpenFlow 1.0 switch always | |
85 | handles packets that do not match any flow in the last table.) | |
86 | .RE | |
82c22d34 BP |
87 | .IP |
88 | In OpenFlow 1.4 and later (which must be enabled with the \fB\-O\fR | |
89 | option) only, \fBmod\-table\fR configures the behavior when a | |
90 | controller attempts to add a flow to a flow table that is full. The | |
91 | following \fIsetting\fR values are available: | |
92 | .RS | |
93 | .IP \fBevict\fR | |
94 | Delete some existing flow from the flow table, according to the | |
95 | algorithm described for the \fBFlow_Table\fR table in | |
96 | \fBovs-vswitchd.conf.db\fR(5). | |
97 | .IP \fBnoevict\fR | |
98 | Refuse to add the new flow. (Eviction might still be enabled through | |
99 | the \fBoverflow_policy\fR oclumn in the \fBFlow_Table\fR table | |
100 | documented in \fBovs-vswitchd.conf.db\fR(5).) | |
101 | .RE | |
c354fcc5 | 102 | . |
064af421 | 103 | .TP |
4e312e69 | 104 | \fBdump\-ports \fIswitch\fR [\fInetdev\fR] |
abaad8cf JP |
105 | Prints to the console statistics for network devices associated with |
106 | \fIswitch\fR. If \fInetdev\fR is specified, only the statistics | |
107 | associated with that device will be printed. \fInetdev\fR can be an | |
108 | OpenFlow assigned port number or device name, e.g. \fBeth0\fR. | |
a9b4a41a | 109 | . |
70ae4f93 | 110 | .IP "\fBdump\-ports\-desc \fIswitch\fR [\fIport\fR]" |
2be393ed | 111 | Prints to the console detailed information about network devices |
70ae4f93 BP |
112 | associated with \fIswitch\fR. To dump only a specific port, specify |
113 | its number as \fIport\fR. Otherwise, if \fIport\fR is omitted, or if | |
114 | it is specified as \fBANY\fR, then all ports are printed. This is a | |
115 | subset of the information provided by the \fBshow\fR command. | |
116 | .IP | |
117 | If the connection to \fIswitch\fR negotiates OpenFlow 1.0, 1.2, or | |
118 | 1.2, this command uses an OpenFlow extension only implemented in Open | |
119 | vSwitch (version 1.7 and later). | |
120 | .IP | |
121 | Only OpenFlow 1.5 and later support dumping a specific port. Earlier | |
122 | versions of OpenFlow always dump all ports. | |
2be393ed | 123 | . |
c6100d92 BP |
124 | .IP "\fBmod\-port \fIswitch\fR \fIport\fR \fIaction\fR" |
125 | Modify characteristics of port \fBport\fR in \fIswitch\fR. \fIport\fR | |
126 | may be an OpenFlow port number or name or the keyword \fBLOCAL\fR (the | |
127 | preferred way to refer to the OpenFlow local port). The \fIaction\fR | |
128 | may be any one of the following: | |
a9b4a41a | 129 | . |
064af421 | 130 | .RS |
28124950 BP |
131 | .IQ \fBup\fR |
132 | .IQ \fBdown\fR | |
133 | Enable or disable the interface. This is equivalent to \fBifconfig | |
134 | up\fR or \fBifconfig down\fR on a Unix system. | |
135 | . | |
136 | .IP \fBstp\fR | |
137 | .IQ \fBno\-stp\fR | |
138 | Enable or disable 802.1D spanning tree protocol (STP) on the | |
139 | interface. OpenFlow implementations that don't support STP will | |
140 | refuse to enable it. | |
141 | . | |
142 | .IP \fBreceive\fR | |
143 | .IQ \fBno\-receive\fR | |
144 | .IQ \fBreceive\-stp\fR | |
145 | .IQ \fBno\-receive\-stp\fR | |
146 | Enable or disable OpenFlow processing of packets received on this | |
147 | interface. When packet processing is disabled, packets will be | |
148 | dropped instead of being processed through the OpenFlow table. The | |
149 | \fBreceive\fR or \fBno\-receive\fR setting applies to all packets | |
150 | except 802.1D spanning tree packets, which are separately controlled | |
151 | by \fBreceive\-stp\fR or \fBno\-receive\-stp\fR. | |
a9b4a41a | 152 | . |
451256f6 | 153 | .IP \fBforward\fR |
28124950 BP |
154 | .IQ \fBno\-forward\fR |
155 | Allow or disallow forwarding of traffic to this interface. By | |
156 | default, forwarding is enabled. | |
451256f6 | 157 | . |
064af421 | 158 | .IP \fBflood\fR |
28124950 BP |
159 | .IQ \fBno\-flood\fR |
160 | Controls whether an OpenFlow \fBflood\fR action will send traffic out | |
161 | this interface. By default, flooding is enabled. Disabling flooding | |
162 | is primarily useful to prevent loops when a spanning tree protocol is | |
163 | not in use. | |
164 | . | |
165 | .IP \fBpacket\-in\fR | |
166 | .IQ \fBno\-packet\-in\fR | |
167 | Controls whether packets received on this interface that do not match | |
168 | a flow table entry generate a ``packet in'' message to the OpenFlow | |
169 | controller. By default, ``packet in'' messages are enabled. | |
064af421 | 170 | .RE |
28124950 BP |
171 | .IP |
172 | The \fBshow\fR command displays (among other information) the | |
173 | configuration that \fBmod\-port\fR changes. | |
a9b4a41a | 174 | . |
7257b535 BP |
175 | .IP "\fBget\-frags \fIswitch\fR" |
176 | Prints \fIswitch\fR's fragment handling mode. See \fBset\-frags\fR, | |
177 | below, for a description of each fragment handling mode. | |
178 | .IP | |
179 | The \fBshow\fR command also prints the fragment handling mode among | |
180 | its other output. | |
181 | . | |
182 | .IP "\fBset\-frags \fIswitch frag_mode\fR" | |
183 | Configures \fIswitch\fR's treatment of IPv4 and IPv6 fragments. The | |
184 | choices for \fIfrag_mode\fR are: | |
185 | .RS | |
186 | .IP "\fBnormal\fR" | |
187 | Fragments pass through the flow table like non-fragmented packets. | |
188 | The TCP ports, UDP ports, and ICMP type and code fields are always set | |
189 | to 0, even for fragments where that information would otherwise be | |
190 | available (fragments with offset 0). This is the default fragment | |
191 | handling mode for an OpenFlow switch. | |
192 | .IP "\fBdrop\fR" | |
193 | Fragments are dropped without passing through the flow table. | |
194 | .IP "\fBreassemble\fR" | |
195 | The switch reassembles fragments into full IP packets before passing | |
196 | them through the flow table. Open vSwitch does not implement this | |
197 | fragment handling mode. | |
198 | .IP "\fBnx\-match\fR" | |
199 | Fragments pass through the flow table like non-fragmented packets. | |
200 | The TCP ports, UDP ports, and ICMP type and code fields are available | |
201 | for matching for fragments with offset 0, and set to 0 in fragments | |
202 | with nonzero offset. This mode is a Nicira extension. | |
203 | .RE | |
204 | .IP | |
205 | See the description of \fBip_frag\fR, below, for a way to match on | |
206 | whether a packet is a fragment and on its fragment offset. | |
207 | . | |
064af421 | 208 | .TP |
4e312e69 | 209 | \fBdump\-flows \fIswitch \fR[\fIflows\fR] |
064af421 BP |
210 | Prints to the console all flow entries in \fIswitch\fR's |
211 | tables that match \fIflows\fR. If \fIflows\fR is omitted, all flows | |
212 | in the switch are retrieved. See \fBFlow Syntax\fR, below, for the | |
bdcc5925 | 213 | syntax of \fIflows\fR. The output format is described in |
064af421 | 214 | \fBTable Entry Output\fR. |
a9b4a41a | 215 | . |
bdcc5925 BP |
216 | .IP |
217 | By default, \fBovs\-ofctl\fR prints flow entries in the same order | |
218 | that the switch sends them, which is unlikely to be intuitive or | |
219 | consistent. See the description of \fB\-\-sort\fR and \fB\-\-rsort\fR, | |
220 | under \fBOPTIONS\fR below, to influence the display order. | |
221 | . | |
064af421 | 222 | .TP |
4e312e69 | 223 | \fBdump\-aggregate \fIswitch \fR[\fIflows\fR] |
bdcc5925 | 224 | Prints to the console aggregate statistics for flows in |
064af421 BP |
225 | \fIswitch\fR's tables that match \fIflows\fR. If \fIflows\fR is omitted, |
226 | the statistics are aggregated across all flows in the switch's flow | |
227 | tables. See \fBFlow Syntax\fR, below, for the syntax of \fIflows\fR. | |
3845a3fd | 228 | The output format is described in \fBTable Entry Output\fR. |
a9b4a41a | 229 | . |
d2805da2 BP |
230 | .IP "\fBqueue\-stats \fIswitch \fR[\fIport \fR[\fIqueue\fR]]" |
231 | Prints to the console statistics for the specified \fIqueue\fR on | |
c6100d92 BP |
232 | \fIport\fR within \fIswitch\fR. \fIport\fR can be an OpenFlow port |
233 | number or name, the keyword \fBLOCAL\fR (the preferred way to refer to | |
234 | the OpenFlow local port), or the keyword \fBALL\fR. Either of | |
235 | \fIport\fR or \fIqueue\fR or both may be omitted (or equivalently the | |
236 | keyword \fBALL\fR). If both are omitted, statistics are printed for | |
237 | all queues on all ports. If only \fIqueue\fR is omitted, then | |
238 | statistics are printed for all queues on \fIport\fR; if only | |
239 | \fIport\fR is omitted, then statistics are printed for \fIqueue\fR on | |
240 | every port where it exists. | |
d2805da2 | 241 | . |
3200ed58 | 242 | .SS "OpenFlow 1.1+ Group Table Commands" |
7395c052 NZ |
243 | . |
244 | The following commands work only with switches that support OpenFlow | |
245 | 1.1 or later. Because support for OpenFlow 1.1 and later is still | |
246 | experimental in Open vSwitch, it is necessary to explicitly enable | |
247 | these protocol versions in \fBovs\-ofctl\fR (using \fB\-O\fR) and in | |
248 | the switch itself (with the \fBprotocols\fR column in the \fBBridge\fR | |
249 | table). For more information, see ``Q: What versions of OpenFlow does | |
250 | Open vSwitch support?'' in the Open vSwitch FAQ. | |
251 | . | |
19187a71 BP |
252 | .IP "\fBdump\-groups \fIswitch\fR [\fIgroup\fR]" |
253 | Prints group entries in \fIswitch\fR's tables to console. To dump | |
254 | only a specific group, specify its number as \fIgroup\fR. Otherwise, | |
255 | if \fIgroup\fR is omitted, or if it is specified as \fBALL\fR, then | |
256 | all groups are printed. Each line of output is a group entry as | |
257 | described in \fBGroup Syntax\fR below. | |
258 | .IP | |
259 | Only OpenFlow 1.5 and later support dumping a specific group. Earlier | |
260 | versions of OpenFlow always dump all groups. | |
7395c052 NZ |
261 | . |
262 | .IP "\fBdump\-group\-features \fIswitch" | |
263 | Prints to the console the group features of the \fIswitch\fR. | |
264 | . | |
265 | .IP "\fBdump\-group-stats \fIswitch \fR[\fIgroups\fR]" | |
266 | Prints to the console statistics for the specified \fIgroups in the | |
267 | \fIswitch\fR's tables. If \fIgroups\fR is omitted then statistics for all | |
268 | groups are printed. See \fBGroup Syntax\fR, below, for the syntax of | |
269 | \fIgroups\fR. | |
270 | . | |
3200ed58 JR |
271 | .SS "OpenFlow 1.3+ Switch Meter Table Commands" |
272 | . | |
273 | These commands manage the meter table in an OpenFlow switch. In each | |
274 | case, \fImeter\fR specifies a meter entry in the format described in | |
275 | \fBMeter Syntax\fR, below. | |
276 | . | |
277 | .PP | |
278 | OpenFlow 1.3 introduced support for meters, so these commands only | |
279 | work with switches that support OpenFlow 1.3 or later. The caveats | |
280 | described for groups in the previous section also apply to meters. | |
281 | . | |
282 | .IP "\fBadd\-meter \fIswitch meter\fR" | |
283 | Add a meter entry to \fIswitch\fR's tables. The \fImeter\fR syntax is | |
284 | described in section \fBMeter Syntax\fR, below. | |
285 | . | |
286 | .IP "\fBmod\-meter \fIswitch meter\fR" | |
287 | Modify an existing meter. | |
288 | . | |
289 | .IP "\fBdel\-meters \fIswitch\fR" | |
290 | .IQ "\fBdel\-meter \fIswitch\fR [\fImeter\fR]" | |
291 | Delete entries from \fIswitch\fR's meter table. \fImeter\fR can specify | |
292 | a single meter with syntax \fBmeter=\fIid\fR, or all meters with syntax | |
293 | \fBmeter=all\fR. | |
294 | . | |
295 | .IP "\fBdump\-meters \fIswitch\fR" | |
296 | .IQ "\fBdump\-meter \fIswitch\fR [\fImeter\fR]" | |
297 | Print meter configuration. \fImeter\fR can specify a single meter with | |
298 | syntax \fBmeter=\fIid\fR, or all meters with syntax \fBmeter=all\fR. | |
299 | . | |
300 | .IP "\fBmeter\-stats \fIswitch\fR [\fImeter\fR]" | |
301 | Print meter statistics. \fImeter\fR can specify a single meter with | |
302 | syntax \fBmeter=\fIid\fR, or all meters with syntax \fBmeter=all\fR. | |
303 | . | |
304 | .IP "\fBmeter\-features \fIswitch\fR" | |
305 | Print meter features. | |
306 | . | |
4989c59f BP |
307 | .SS "OpenFlow Switch Flow Table Commands" |
308 | . | |
309 | These commands manage the flow table in an OpenFlow switch. In each | |
310 | case, \fIflow\fR specifies a flow entry in the format described in | |
db5076ee JR |
311 | \fBFlow Syntax\fR, below, \fIfile\fR is a text file that contains zero |
312 | or more flows in the same syntax, one per line, and the optional | |
39c94593 JR |
313 | \fB\-\-bundle\fR option operates the command as a single atomic |
314 | transation, see option \fB\-\-bundle\fR, below. | |
db5076ee JR |
315 | . |
316 | .IP "[\fB\-\-bundle\fR] \fBadd\-flow \fIswitch flow\fR" | |
317 | .IQ "[\fB\-\-bundle\fR] \fBadd\-flow \fIswitch \fB\- < \fIfile\fR" | |
318 | .IQ "[\fB\-\-bundle\fR] \fBadd\-flows \fIswitch file\fR" | |
4989c59f BP |
319 | Add each flow entry to \fIswitch\fR's tables. |
320 | . | |
db5076ee JR |
321 | Each flow specification (e.g., each line in \fIfile\fR) may start with |
322 | \fBadd\fR, \fBmodify\fR, \fBdelete\fR, \fBmodify_strict\fR, or | |
323 | \fBdelete_strict\fR keyword to specify whether a flow is to be added, | |
324 | modified, or deleted, and whether the modify or delete is strict or | |
325 | not. For backwards compatibility a flow specification without one of | |
326 | these keywords is treated as a flow add. All flow mods are executed | |
327 | in the order specified. | |
328 | . | |
329 | .IP "[\fB\-\-bundle\fR] [\fB\-\-strict\fR] \fBmod\-flows \fIswitch flow\fR" | |
330 | .IQ "[\fB\-\-bundle\fR] [\fB\-\-strict\fR] \fBmod\-flows \fIswitch \fB\- < \fIfile\fR" | |
4989c59f BP |
331 | Modify the actions in entries from \fIswitch\fR's tables that match |
332 | the specified flows. With \fB\-\-strict\fR, wildcards are not treated | |
333 | as active for matching purposes. | |
334 | . | |
db5076ee JR |
335 | .IP "[\fB\-\-bundle\fR] \fBdel\-flows \fIswitch\fR" |
336 | .IQ "[\fB\-\-bundle\fR] [\fB\-\-strict\fR] \fBdel\-flows \fIswitch \fR[\fIflow\fR]" | |
337 | .IQ "[\fB\-\-bundle\fR] [\fB\-\-strict\fR] \fBdel\-flows \fIswitch \fB\- < \fIfile\fR" | |
4989c59f BP |
338 | Deletes entries from \fIswitch\fR's flow table. With only a |
339 | \fIswitch\fR argument, deletes all flows. Otherwise, deletes flow | |
340 | entries that match the specified flows. With \fB\-\-strict\fR, | |
341 | wildcards are not treated as active for matching purposes. | |
a9b4a41a | 342 | . |
db5076ee | 343 | .IP "[\fB\-\-bundle\fR] [\fB\-\-readd\fR] \fBreplace\-flows \fIswitch file\fR" |
0199c526 BP |
344 | Reads flow entries from \fIfile\fR (or \fBstdin\fR if \fIfile\fR is |
345 | \fB\-\fR) and queries the flow table from \fIswitch\fR. Then it fixes | |
346 | up any differences, adding flows from \fIflow\fR that are missing on | |
347 | \fIswitch\fR, deleting flows from \fIswitch\fR that are not in | |
348 | \fIfile\fR, and updating flows in \fIswitch\fR whose actions, cookie, | |
349 | or timeouts differ in \fIfile\fR. | |
350 | . | |
c4ea79bf BP |
351 | .IP |
352 | With \fB\-\-readd\fR, \fBovs\-ofctl\fR adds all the flows from | |
353 | \fIfile\fR, even those that exist with the same actions, cookie, and | |
354 | timeout in \fIswitch\fR. This resets all the flow packet and byte | |
355 | counters to 0, which can be useful for debugging. | |
356 | . | |
0199c526 BP |
357 | .IP "\fBdiff\-flows \fIsource1 source2\fR" |
358 | Reads flow entries from \fIsource1\fR and \fIsource2\fR and prints the | |
359 | differences. A flow that is in \fIsource1\fR but not in \fIsource2\fR | |
360 | is printed preceded by a \fB\-\fR, and a flow that is in \fIsource2\fR | |
361 | but not in \fIsource1\fR is printed preceded by a \fB+\fR. If a flow | |
362 | exists in both \fIsource1\fR and \fIsource2\fR with different actions, | |
363 | cookie, or timeouts, then both versions are printed preceded by | |
364 | \fB\-\fR and \fB+\fR, respectively. | |
365 | .IP | |
366 | \fIsource1\fR and \fIsource2\fR may each name a file or a switch. If | |
367 | a name begins with \fB/\fR or \fB.\fR, then it is considered to be a | |
368 | file name. A name that contains \fB:\fR is considered to be a switch. | |
369 | Otherwise, it is a file if a file by that name exists, a switch if | |
370 | not. | |
371 | .IP | |
372 | For this command, an exit status of 0 means that no differences were | |
373 | found, 1 means that an error occurred, and 2 means that some | |
374 | differences were found. | |
375 | . | |
0c3d5fc8 BP |
376 | .IP "\fBpacket\-out \fIswitch in_port actions packet\fR..." |
377 | Connects to \fIswitch\fR and instructs it to execute the OpenFlow | |
4eb58d34 BP |
378 | \fIactions\fR on each \fIpacket\fR. Each \fBpacket\fR is specified as a |
379 | series of hex digits. For the purpose of executing the | |
0c3d5fc8 | 380 | actions, the packets are considered to have arrived on \fIin_port\fR, |
c6100d92 BP |
381 | which may be an OpenFlow port number or name (e.g. \fBeth0\fR), the |
382 | keyword \fBLOCAL\fR (the preferred way to refer to the OpenFlow | |
383 | ``local'' port), or the keyword \fBNONE\fR to indicate that the packet | |
384 | was generated by the switch itself. | |
0c3d5fc8 | 385 | . |
7395c052 NZ |
386 | .SS "OpenFlow Switch Group Table Commands" |
387 | . | |
388 | These commands manage the group table in an OpenFlow switch. In each | |
389 | case, \fIgroup\fR specifies a group entry in the format described in | |
390 | \fBGroup Syntax\fR, below, and \fIfile\fR is a text file that contains | |
391 | zero or more groups in the same syntax, one per line. | |
392 | ||
393 | .IP "\fBadd\-group \fIswitch group\fR" | |
394 | .IQ "\fBadd\-group \fIswitch \fB\- < \fIfile\fR" | |
395 | .IQ "\fBadd\-groups \fIswitch file\fR" | |
396 | Add each group entry to \fIswitch\fR's tables. | |
397 | . | |
398 | .IP "\fBmod\-group \fIswitch group\fR" | |
399 | .IQ "\fBmod\-group \fIswitch \fB\- < \fIfile\fR" | |
400 | Modify the action buckets in entries from \fIswitch\fR's tables for | |
401 | each group entry. | |
402 | . | |
403 | .IP "\fBdel\-groups \fIswitch\fR" | |
404 | .IQ "\fBdel\-groups \fIswitch \fR[\fIgroup\fR]" | |
405 | .IQ "\fBdel\-groups \fIswitch \fB\- < \fIfile\fR" | |
406 | Deletes entries from \fIswitch\fR's group table. With only a | |
407 | \fIswitch\fR argument, deletes all groups. Otherwise, deletes the group | |
408 | for each group entry. | |
409 | . | |
bdbb8426 SH |
410 | .IP "\fBinsert\-buckets \fIswitch group\fR" |
411 | .IQ "\fBinsert\-buckets \fIswitch \fB\- < \fIfile\fR" | |
412 | Add buckets to an existing group present in the \fIswitch\fR's group table. | |
413 | If no \fIcommand_bucket_id\fR is present in the group specification then all | |
414 | buckets of the group are removed. | |
415 | . | |
416 | .IP "\fBremove\-buckets \fIswitch group\fR" | |
417 | .IQ "\fBremove\-buckets \fIswitch \fB\- < \fIfile\fR" | |
418 | Remove buckets to an existing group present in the \fIswitch\fR's group table. | |
419 | If no \fIcommand_bucket_id\fR is present in the group specification then all | |
420 | buckets of the group are removed. | |
421 | . | |
6159c531 JG |
422 | .SS "OpenFlow Switch Geneve Option Table Commands" |
423 | . | |
424 | In order to work with Geneve options, it is necessary to maintain a mapping | |
425 | table between an option (defined by <class, type, length>) and an NXM field | |
426 | that can be operated on for the purposes of matches, actions, etc. This | |
427 | mapping must be explicitly specified by the user through the following | |
428 | commands. The format for \fIoptions\fR is given in \fBOption Syntax\fR below. | |
429 | ||
430 | Note that a given mapping should not be changed while it is in active use by | |
431 | a flow. The result of doing so is undefined. | |
432 | ||
9558d2a5 JG |
433 | Currently, the Geneve mapping table is shared between all OpenFlow |
434 | switches in a given instance of Open vSwitch. This restriction will | |
435 | be lifted in the future to allow for easier management. | |
436 | ||
6159c531 JG |
437 | These commands are Nicira extensions to OpenFlow and require Open vSwitch |
438 | 2.5 or later. | |
439 | ||
440 | .IP "\fBadd\-geneve\-map \fIswitch options\fR" | |
441 | Add each option entry to \fIswitch\fR's tables. Duplicate fields are | |
442 | rejected. | |
443 | . | |
444 | .IP "\fBdel\-geneve\-map \fIswitch \fR[\fIoptions\fR]" | |
445 | Delete each option entry in \fIswitch\fR's tables based on its field index. | |
446 | Fields that aren't already mapped will be ignored. If no options are | |
447 | specified then the entire table will be cleared. | |
448 | . | |
449 | .IP "\fBdump\-geneve\-map \fIswitch\fR" | |
450 | Show the currently mapped fields in the switch's option table as well | |
451 | as switch capabilities. | |
452 | . | |
453 | .IP "\fBOption Syntax\fR" | |
454 | \fB{class=\fIclass\fB,type=\fItype\fB,len=\fIlength\fB}->tun_metadata\fIn\fR | |
455 | ||
456 | An option can be specified in this form (repeating as necessary and | |
457 | separated by commas). For example, the follow is used to map a new option: | |
458 | ||
459 | .RS | |
460 | add-geneve-map br0 "{class=0xffff,type=0,len=4}->tun_metadata0" | |
461 | .RE | |
462 | . | |
4989c59f BP |
463 | .SS "OpenFlow Switch Monitoring Commands" |
464 | . | |
0caf6bde BP |
465 | .IP "\fBsnoop \fIswitch\fR" |
466 | Connects to \fIswitch\fR and prints to the console all OpenFlow | |
467 | messages received. Unlike other \fBovs\-ofctl\fR commands, if | |
468 | \fIswitch\fR is the name of a bridge, then the \fBsnoop\fR command | |
469 | connects to a Unix domain socket named | |
421e818c | 470 | \fB@RUNDIR@/\fIswitch\fB.snoop\fR. \fBovs\-vswitchd\fR listens on |
0caf6bde BP |
471 | such a socket for each bridge and sends to it all of the OpenFlow |
472 | messages sent to or received from its configured OpenFlow controller. | |
473 | Thus, this command can be used to view OpenFlow protocol activity | |
474 | between a switch and its controller. | |
475 | .IP | |
476 | When a switch has more than one controller configured, only the | |
e2bfacb6 BP |
477 | traffic to and from a single controller is output. If none of the |
478 | controllers is configured as a master or a slave (using a Nicira | |
70d0aed3 BP |
479 | extension to OpenFlow 1.0 or 1.1, or a standard request in OpenFlow |
480 | 1.2 or later), then a controller is chosen arbitrarily among | |
e2bfacb6 BP |
481 | them. If there is a master controller, it is chosen; otherwise, if |
482 | there are any controllers that are not masters or slaves, one is | |
483 | chosen arbitrarily; otherwise, a slave controller is chosen | |
484 | arbitrarily. This choice is made once at connection time and does not | |
485 | change as controllers reconfigure their roles. | |
486 | .IP | |
487 | If a switch has no controller configured, or if | |
0caf6bde BP |
488 | the configured controller is disconnected, no traffic is sent, so |
489 | monitoring will not show any traffic. | |
490 | . | |
2b07c8b1 | 491 | .IP "\fBmonitor \fIswitch\fR [\fImiss-len\fR] [\fBinvalid_ttl\fR] [\fBwatch:\fR[\fIspec\fR...]]" |
064af421 | 492 | Connects to \fIswitch\fR and prints to the console all OpenFlow |
045b2e5c BP |
493 | messages received. Usually, \fIswitch\fR should specify the name of a |
494 | bridge in the \fBovs\-vswitchd\fR database. | |
a9b4a41a | 495 | .IP |
064af421 BP |
496 | If \fImiss-len\fR is provided, \fBovs\-ofctl\fR sends an OpenFlow ``set |
497 | configuration'' message at connection setup time that requests | |
0caf6bde BP |
498 | \fImiss-len\fR bytes of each packet that misses the flow table. Open vSwitch |
499 | does not send these and other asynchronous messages to an | |
064af421 | 500 | \fBovs\-ofctl monitor\fR client connection unless a nonzero value is |
0caf6bde BP |
501 | specified on this argument. (Thus, if \fImiss\-len\fR is not |
502 | specified, very little traffic will ordinarily be printed.) | |
a9b4a41a | 503 | .IP |
f0fd1a17 PS |
504 | If \fBinvalid_ttl\fR is passed, \fBovs\-ofctl\fR sends an OpenFlow ``set |
505 | configuration'' message at connection setup time that requests | |
5484c47a BP |
506 | \fBINVALID_TTL_TO_CONTROLLER\fR, so that \fBovs\-ofctl monitor\fR can |
507 | receive ``packet-in'' messages when TTL reaches zero on \fBdec_ttl\fR action. | |
f0fd1a17 | 508 | .IP |
2b07c8b1 BP |
509 | \fBwatch:\fR[\fB\fIspec\fR...] causes \fBovs\-ofctl\fR to send a |
510 | ``monitor request'' Nicira extension message to the switch at | |
511 | connection setup time. This message causes the switch to send | |
512 | information about flow table changes as they occur. The following | |
513 | comma-separated \fIspec\fR syntax is available: | |
514 | .RS | |
515 | .IP "\fB!initial\fR" | |
516 | Do not report the switch's initial flow table contents. | |
517 | .IP "\fB!add\fR" | |
518 | Do not report newly added flows. | |
519 | .IP "\fB!delete\fR" | |
520 | Do not report deleted flows. | |
521 | .IP "\fB!modify\fR" | |
522 | Do not report modifications to existing flows. | |
523 | .IP "\fB!own\fR" | |
524 | Abbreviate changes made to the flow table by \fBovs\-ofctl\fR's own | |
525 | connection to the switch. (These could only occur using the | |
526 | \fBofctl/send\fR command described below under \fBRUNTIME MANAGEMENT | |
527 | COMMANDS\fR.) | |
528 | .IP "\fB!actions\fR" | |
529 | Do not report actions as part of flow updates. | |
530 | .IP "\fBtable=\fInumber\fR" | |
531 | Limits the monitoring to the table with the given \fInumber\fR between | |
532 | 0 and 254. By default, all tables are monitored. | |
533 | .IP "\fBout_port=\fIport\fR" | |
c6100d92 BP |
534 | If set, only flows that output to \fIport\fR are monitored. The |
535 | \fIport\fR may be an OpenFlow port number or keyword | |
536 | (e.g. \fBLOCAL\fR). | |
2b07c8b1 BP |
537 | .IP "\fIfield\fB=\fIvalue\fR" |
538 | Monitors only flows that have \fIfield\fR specified as the given | |
539 | \fIvalue\fR. Any syntax valid for matching on \fBdump\-flows\fR may | |
540 | be used. | |
541 | .RE | |
542 | .IP | |
064af421 | 543 | This command may be useful for debugging switch or controller |
2b07c8b1 BP |
544 | implementations. With \fBwatch:\fR, it is particularly useful for |
545 | observing how a controller updates flow tables. | |
a9b4a41a | 546 | . |
064af421 | 547 | .SS "OpenFlow Switch and Controller Commands" |
a9b4a41a | 548 | . |
064af421 BP |
549 | The following commands, like those in the previous section, may be |
550 | applied to OpenFlow switches, using any of the connection methods | |
551 | described in that section. Unlike those commands, these may also be | |
552 | applied to OpenFlow controllers. | |
a9b4a41a | 553 | . |
064af421 BP |
554 | .TP |
555 | \fBprobe \fItarget\fR | |
556 | Sends a single OpenFlow echo-request message to \fItarget\fR and waits | |
4e312e69 | 557 | for the response. With the \fB\-t\fR or \fB\-\-timeout\fR option, this |
064af421 BP |
558 | command can test whether an OpenFlow switch or controller is up and |
559 | running. | |
a9b4a41a | 560 | . |
064af421 BP |
561 | .TP |
562 | \fBping \fItarget \fR[\fIn\fR] | |
563 | Sends a series of 10 echo request packets to \fItarget\fR and times | |
564 | each reply. The echo request packets consist of an OpenFlow header | |
565 | plus \fIn\fR bytes (default: 64) of randomly generated payload. This | |
566 | measures the latency of individual requests. | |
a9b4a41a | 567 | . |
064af421 BP |
568 | .TP |
569 | \fBbenchmark \fItarget n count\fR | |
570 | Sends \fIcount\fR echo request packets that each consist of an | |
571 | OpenFlow header plus \fIn\fR bytes of payload and waits for each | |
572 | response. Reports the total time required. This is a measure of the | |
573 | maximum bandwidth to \fItarget\fR for round-trips of \fIn\fR-byte | |
574 | messages. | |
a9b4a41a | 575 | . |
1ac0e975 BP |
576 | .SS "Other Commands" |
577 | . | |
578 | .IP "\fBofp\-parse\fR \fIfile\fR" | |
579 | Reads \fIfile\fR (or \fBstdin\fR if \fIfile\fR is \fB\-\fR) as a | |
580 | series of OpenFlow messages in the binary format used on an OpenFlow | |
581 | connection, and prints them to the console. This can be useful for | |
582 | printing OpenFlow messages captured from a TCP stream. | |
583 | . | |
f3dd1419 BP |
584 | .IP "\fBofp\-parse\-pcap\fR \fIfile\fR [\fIport\fR...]" |
585 | Reads \fIfile\fR, which must be in the PCAP format used by network | |
586 | capture tools such as \fBtcpdump\fR or \fBwireshark\fR, extracts all | |
587 | the TCP streams for OpenFlow connections, and prints the OpenFlow | |
588 | messages in those connections in human-readable format on | |
589 | \fBstdout\fR. | |
590 | .IP | |
591 | OpenFlow connections are distinguished by TCP port number. | |
592 | Non-OpenFlow packets are ignored. By default, data on TCP ports 6633 | |
593 | and 6653 are considered to be OpenFlow. Specify one or more | |
594 | \fIport\fR arguments to override the default. | |
595 | .IP | |
596 | This command cannot usefully print SSL encrypted traffic. It does not | |
597 | understand IPv6. | |
598 | . | |
064af421 | 599 | .SS "Flow Syntax" |
a9b4a41a | 600 | .PP |
064af421 BP |
601 | Some \fBovs\-ofctl\fR commands accept an argument that describes a flow or |
602 | flows. Such flow descriptions comprise a series | |
603 | \fIfield\fB=\fIvalue\fR assignments, separated by commas or white | |
604 | space. (Embedding spaces into a flow description normally requires | |
605 | quoting to prevent the shell from breaking the description into | |
606 | multiple arguments.) | |
a9b4a41a | 607 | .PP |
0b3f2725 BP |
608 | Flow descriptions should be in \fBnormal form\fR. This means that a |
609 | flow may only specify a value for an L3 field if it also specifies a | |
610 | particular L2 protocol, and that a flow may only specify an L4 field | |
611 | if it also specifies particular L2 and L3 protocol types. For | |
612 | example, if the L2 protocol type \fBdl_type\fR is wildcarded, then L3 | |
613 | fields \fBnw_src\fR, \fBnw_dst\fR, and \fBnw_proto\fR must also be | |
614 | wildcarded. Similarly, if \fBdl_type\fR or \fBnw_proto\fR (the L3 | |
1c58a78b BP |
615 | protocol type) is wildcarded, so must be the L4 fields \fBtcp_dst\fR and |
616 | \fBtcp_src\fR. \fBovs\-ofctl\fR will warn about | |
0b3f2725 BP |
617 | flows not in normal form. |
618 | .PP | |
064af421 BP |
619 | The following field assignments describe how a flow matches a packet. |
620 | If any of these assignments is omitted from the flow syntax, the field | |
621 | is treated as a wildcard; thus, if all of them are omitted, the | |
bedde04c GS |
622 | resulting flow matches all packets. The string \fB*\fR may be specified |
623 | to explicitly mark any of these fields as a wildcard. | |
064af421 | 624 | (\fB*\fR should be quoted to protect it from shell expansion.) |
a9b4a41a | 625 | . |
c6100d92 BP |
626 | .IP \fBin_port=\fIport\fR |
627 | Matches OpenFlow port \fIport\fR, which may be an OpenFlow port number | |
628 | or keyword (e.g. \fBLOCAL\fR). | |
629 | \fBovs\-ofctl show\fR. | |
03a8a29e BP |
630 | .IP |
631 | (The \fBresubmit\fR action can search OpenFlow flow tables with | |
632 | arbitrary \fBin_port\fR values, so flows that match port numbers that | |
633 | do not exist from an OpenFlow perspective can still potentially be | |
634 | matched.) | |
a9b4a41a | 635 | . |
064af421 | 636 | .IP \fBdl_vlan=\fIvlan\fR |
f30f26be JP |
637 | Matches IEEE 802.1q Virtual LAN tag \fIvlan\fR. Specify \fB0xffff\fR |
638 | as \fIvlan\fR to match packets that are not tagged with a Virtual LAN; | |
064af421 BP |
639 | otherwise, specify a number between 0 and 4095, inclusive, as the |
640 | 12-bit VLAN ID to match. | |
a9b4a41a | 641 | . |
959a2ecd JP |
642 | .IP \fBdl_vlan_pcp=\fIpriority\fR |
643 | Matches IEEE 802.1q Priority Code Point (PCP) \fIpriority\fR, which is | |
644 | specified as a value between 0 and 7, inclusive. A higher value | |
645 | indicates a higher frame priority level. | |
a9b4a41a | 646 | . |
ed951f15 BP |
647 | .IP \fBdl_src=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
648 | .IQ \fBdl_dst=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
649 | Matches an Ethernet source (or destination) address specified as 6 | |
650 | pairs of hexadecimal digits delimited by colons | |
651 | (e.g. \fB00:0A:E4:25:6B:B0\fR). | |
652 | . | |
73c0ce34 JS |
653 | .IP \fBdl_src=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB/\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
654 | .IQ \fBdl_dst=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB/\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
cb8ca532 BP |
655 | Matches an Ethernet destination address specified as 6 pairs of |
656 | hexadecimal digits delimited by colons (e.g. \fB00:0A:E4:25:6B:B0\fR), | |
73c0ce34 JS |
657 | with a wildcard mask following the slash. Open vSwitch 1.8 and later |
658 | support arbitrary masks for source and/or destination. Earlier | |
659 | versions only support masking the destination with the following masks: | |
cb8ca532 BP |
660 | .RS |
661 | .IP \fB01:00:00:00:00:00\fR | |
662 | Match only the multicast bit. Thus, | |
663 | \fBdl_dst=01:00:00:00:00:00/01:00:00:00:00:00\fR matches all multicast | |
664 | (including broadcast) Ethernet packets, and | |
665 | \fBdl_dst=00:00:00:00:00:00/01:00:00:00:00:00\fR matches all unicast | |
666 | Ethernet packets. | |
667 | .IP \fBfe:ff:ff:ff:ff:ff\fR | |
668 | Match all bits except the multicast bit. This is probably not useful. | |
669 | .IP \fBff:ff:ff:ff:ff:ff\fR | |
670 | Exact match (equivalent to omitting the mask). | |
671 | .IP \fB00:00:00:00:00:00\fR | |
672 | Wildcard all bits (equivalent to \fBdl_dst=*\fR.) | |
673 | .RE | |
674 | . | |
064af421 BP |
675 | .IP \fBdl_type=\fIethertype\fR |
676 | Matches Ethernet protocol type \fIethertype\fR, which is specified as an | |
677 | integer between 0 and 65535, inclusive, either in decimal or as a | |
678 | hexadecimal number prefixed by \fB0x\fR (e.g. \fB0x0806\fR to match ARP | |
679 | packets). | |
a9b4a41a | 680 | . |
064af421 | 681 | .IP \fBnw_src=\fIip\fR[\fB/\fInetmask\fR] |
ed951f15 BP |
682 | .IQ \fBnw_dst=\fIip\fR[\fB/\fInetmask\fR] |
683 | When \fBdl_type\fR is 0x0800 (possibly via shorthand, e.g. \fBip\fR | |
684 | or \fBtcp\fR), matches IPv4 source (or destination) address \fIip\fR, | |
685 | which may be specified as an IP address or host name | |
686 | (e.g. \fB192.168.1.1\fR or \fBwww.example.com\fR). The optional | |
687 | \fInetmask\fR allows restricting a match to an IPv4 address prefix. | |
688 | The netmask may be specified as a dotted quad | |
689 | (e.g. \fB192.168.1.0/255.255.255.0\fR) or as a CIDR block | |
c08201d6 BP |
690 | (e.g. \fB192.168.1.0/24\fR). Open vSwitch 1.8 and later support |
691 | arbitrary dotted quad masks; earlier versions support only CIDR masks, | |
692 | that is, the dotted quads that are equivalent to some CIDR block. | |
ed951f15 BP |
693 | .IP |
694 | When \fBdl_type=0x0806\fR or \fBarp\fR is specified, matches the | |
695 | \fBar_spa\fR or \fBar_tpa\fR field, respectively, in ARP packets for | |
696 | IPv4 and Ethernet. | |
697 | .IP | |
8087f5ff MM |
698 | When \fBdl_type=0x8035\fR or \fBrarp\fR is specified, matches the |
699 | \fBar_spa\fR or \fBar_tpa\fR field, respectively, in RARP packets for | |
700 | IPv4 and Ethernet. | |
701 | .IP | |
702 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800, | |
703 | 0x0806, or 0x8035, the values of \fBnw_src\fR and \fBnw_dst\fR are ignored | |
0b3f2725 | 704 | (see \fBFlow Syntax\fR above). |
a9b4a41a | 705 | . |
064af421 | 706 | .IP \fBnw_proto=\fIproto\fR |
44a7e26d | 707 | .IQ \fBip_proto=\fIproto\fR |
ed951f15 BP |
708 | When \fBip\fR or \fBdl_type=0x0800\fR is specified, matches IP |
709 | protocol type \fIproto\fR, which is specified as a decimal number | |
d31f1109 JP |
710 | between 0 and 255, inclusive (e.g. 1 to match ICMP packets or 6 to match |
711 | TCP packets). | |
712 | .IP | |
713 | When \fBipv6\fR or \fBdl_type=0x86dd\fR is specified, matches IPv6 | |
714 | header type \fIproto\fR, which is specified as a decimal number between | |
715 | 0 and 255, inclusive (e.g. 58 to match ICMPv6 packets or 6 to match | |
716 | TCP). The header type is the terminal header as described in the | |
717 | \fBDESIGN\fR document. | |
ed951f15 BP |
718 | .IP |
719 | When \fBarp\fR or \fBdl_type=0x0806\fR is specified, matches the lower | |
720 | 8 bits of the ARP opcode. ARP opcodes greater than 255 are treated as | |
721 | 0. | |
722 | .IP | |
8087f5ff MM |
723 | When \fBrarp\fR or \fBdl_type=0x8035\fR is specified, matches the lower |
724 | 8 bits of the ARP opcode. ARP opcodes greater than 255 are treated as | |
725 | 0. | |
726 | .IP | |
d31f1109 | 727 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800, |
8087f5ff MM |
728 | 0x0806, 0x8035 or 0x86dd, the value of \fBnw_proto\fR is ignored (see |
729 | \fBFlow Syntax\fR above). | |
a9b4a41a | 730 | . |
834377ea | 731 | .IP \fBnw_tos=\fItos\fR |
d31f1109 JP |
732 | Matches IP ToS/DSCP or IPv6 traffic class field \fItos\fR, which is |
733 | specified as a decimal number between 0 and 255, inclusive. Note that | |
734 | the two lower reserved bits are ignored for matching purposes. | |
ed951f15 | 735 | .IP |
5c0ceb0a JP |
736 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800 or |
737 | 0x86dd, the value of \fBnw_tos\fR is ignored (see \fBFlow Syntax\fR | |
738 | above). | |
a9b4a41a | 739 | . |
44a7e26d JR |
740 | .IP \fBip_dscp=\fIdscp\fR |
741 | Matches IP ToS/DSCP or IPv6 traffic class field \fIdscp\fR, which is | |
742 | specified as a decimal number between 0 and 63, inclusive. | |
743 | .IP | |
744 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800 or | |
745 | 0x86dd, the value of \fBip_dscp\fR is ignored (see \fBFlow Syntax\fR | |
746 | above). | |
747 | . | |
530180fd | 748 | .IP \fBnw_ecn=\fIecn\fR |
44a7e26d | 749 | .IQ \fBip_ecn=\fIecn\fR |
530180fd JP |
750 | Matches \fIecn\fR bits in IP ToS or IPv6 traffic class fields, which is |
751 | specified as a decimal number between 0 and 3, inclusive. | |
752 | .IP | |
753 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800 or | |
754 | 0x86dd, the value of \fBnw_ecn\fR is ignored (see \fBFlow Syntax\fR | |
755 | above). | |
756 | . | |
a61680c6 JP |
757 | .IP \fBnw_ttl=\fIttl\fR |
758 | Matches IP TTL or IPv6 hop limit value \fIttl\fR, which is | |
759 | specified as a decimal number between 0 and 255, inclusive. | |
760 | .IP | |
761 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800 or | |
762 | 0x86dd, the value of \fBnw_ttl\fR is ignored (see \fBFlow Syntax\fR | |
763 | above). | |
764 | .IP | |
765 | . | |
1c58a78b BP |
766 | .IP \fBtcp_src=\fIport\fR |
767 | .IQ \fBtcp_dst=\fIport\fR | |
768 | .IQ \fBudp_src=\fIport\fR | |
769 | .IQ \fBudp_dst=\fIport\fR | |
770 | .IQ \fBsctp_src=\fIport\fR | |
771 | .IQ \fBsctp_dst=\fIport\fR | |
772 | Matches a TCP, UDP, or SCTP source or destination port \fIport\fR, | |
773 | which is specified as a decimal number between 0 and 65535, inclusive. | |
774 | .IP | |
775 | When \fBdl_type\fR and \fBnw_proto\fR are wildcarded or set to values | |
776 | that do not indicate an appropriate protocol, the values of these | |
777 | settings are ignored (see \fBFlow Syntax\fR above). | |
778 | . | |
779 | .IP \fBtcp_src=\fIport\fB/\fImask\fR | |
780 | .IQ \fBtcp_dst=\fIport\fB/\fImask\fR | |
781 | .IQ \fBudp_src=\fIport\fB/\fImask\fR | |
782 | .IQ \fBudp_dst=\fIport\fB/\fImask\fR | |
783 | .IQ \fBsctp_src=\fIport\fB/\fImask\fR | |
784 | .IQ \fBsctp_dst=\fIport\fB/\fImask\fR | |
785 | Bitwise match on TCP (or UDP or SCTP) source or destination port. | |
786 | The \fIport\fR and \fImask\fR are 16-bit numbers | |
73f33563 BP |
787 | written in decimal or in hexadecimal prefixed by \fB0x\fR. Each 1-bit |
788 | in \fImask\fR requires that the corresponding bit in \fIport\fR must | |
789 | match. Each 0-bit in \fImask\fR causes the corresponding bit to be | |
790 | ignored. | |
791 | .IP | |
792 | Bitwise matches on transport ports are rarely useful in isolation, but | |
793 | a group of them can be used to reduce the number of flows required to | |
794 | match on a range of transport ports. For example, suppose that the | |
795 | goal is to match TCP source ports 1000 to 1999, inclusive. One way is | |
edcbeb4d | 796 | to insert 1000 flows, each of which matches on a single source port. |
73f33563 BP |
797 | Another way is to look at the binary representations of 1000 and 1999, |
798 | as follows: | |
799 | .br | |
800 | .B "01111101000" | |
801 | .br | |
802 | .B "11111001111" | |
803 | .br | |
804 | and then to transform those into a series of bitwise matches that | |
805 | accomplish the same results: | |
806 | .br | |
807 | .B "01111101xxx" | |
808 | .br | |
809 | .B "0111111xxxx" | |
810 | .br | |
811 | .B "10xxxxxxxxx" | |
812 | .br | |
813 | .B "110xxxxxxxx" | |
814 | .br | |
815 | .B "1110xxxxxxx" | |
816 | .br | |
817 | .B "11110xxxxxx" | |
818 | .br | |
819 | .B "1111100xxxx" | |
820 | .br | |
821 | which become the following when written in the syntax required by | |
822 | \fBovs\-ofctl\fR: | |
823 | .br | |
1c58a78b | 824 | .B "tcp,tcp_src=0x03e8/0xfff8" |
73f33563 | 825 | .br |
1c58a78b | 826 | .B "tcp,tcp_src=0x03f0/0xfff0" |
73f33563 | 827 | .br |
1c58a78b | 828 | .B "tcp,tcp_src=0x0400/0xfe00" |
73f33563 | 829 | .br |
1c58a78b | 830 | .B "tcp,tcp_src=0x0600/0xff00" |
73f33563 | 831 | .br |
1c58a78b | 832 | .B "tcp,tcp_src=0x0700/0xff80" |
73f33563 | 833 | .br |
1c58a78b | 834 | .B "tcp,tcp_src=0x0780/0xffc0" |
73f33563 | 835 | .br |
1c58a78b | 836 | .B "tcp,tcp_src=0x07c0/0xfff0" |
73f33563 BP |
837 | .IP |
838 | Only Open vSwitch 1.6 and later supports bitwise matching on transport | |
839 | ports. | |
840 | .IP | |
1c58a78b | 841 | Like the exact-match forms described |
edcbeb4d | 842 | above, the bitwise match forms apply only when \fBdl_type\fR and |
0d56eaf2 | 843 | \fBnw_proto\fR specify TCP or UDP or SCTP. |
73f33563 | 844 | . |
1c58a78b BP |
845 | .IP \fBtp_src=\fIport\fR |
846 | .IQ \fBtp_dst=\fIport\fR | |
847 | These are deprecated generic forms of L4 port matches. In new code, | |
848 | please use the TCP-, UDP-, or SCTP-specific forms described above. | |
849 | . | |
dc235f7f | 850 | .IP \fBtcp_flags=\fIflags\fB/\fImask\fR |
61bf6666 | 851 | .IQ \fBtcp_flags=\fR[\fB+\fIflag\fR...][\fB-\fIflag\fR...] |
dc235f7f JR |
852 | Bitwise match on TCP flags. The \fIflags\fR and \fImask\fR are 16-bit |
853 | numbers written in decimal or in hexadecimal prefixed by \fB0x\fR. | |
854 | Each 1-bit in \fImask\fR requires that the corresponding bit in | |
855 | \fIflags\fR must match. Each 0-bit in \fImask\fR causes the corresponding | |
856 | bit to be ignored. | |
857 | .IP | |
61bf6666 JR |
858 | Alternatively, the flags can be specified by their symbolic names |
859 | (listed below), each preceded by either \fB+\fR for a flag that must | |
860 | be set, or \fB\-\fR for a flag that must be unset, without any other | |
861 | delimiters between the flags. Flags not mentioned are wildcarded. | |
862 | For example, \fBtcp,tcp_flags=+syn\-ack\fR matches TCP SYNs that are | |
863 | not ACKs. | |
864 | .IP | |
dc235f7f JR |
865 | TCP protocol currently defines 9 flag bits, and additional 3 bits are |
866 | reserved (must be transmitted as zero), see RFCs 793, 3168, and 3540. | |
867 | The flag bits are, numbering from the least significant bit: | |
868 | .RS | |
61bf6666 | 869 | .IP "\fB0: fin\fR" |
dc235f7f | 870 | No more data from sender. |
61bf6666 | 871 | .IP "\fB1: syn\fR" |
dc235f7f | 872 | Synchronize sequence numbers. |
61bf6666 | 873 | .IP "\fB2: rst\fR" |
dc235f7f | 874 | Reset the connection. |
61bf6666 | 875 | .IP "\fB3: psh\fR" |
dc235f7f | 876 | Push function. |
61bf6666 | 877 | .IP "\fB4: ack\fR" |
dc235f7f | 878 | Acknowledgement field significant. |
61bf6666 | 879 | .IP "\fB5: urg\fR" |
dc235f7f | 880 | Urgent pointer field significant. |
61bf6666 | 881 | .IP "\fB6: ece\fR" |
dc235f7f | 882 | ECN Echo. |
61bf6666 | 883 | .IP "\fB7: cwr\fR" |
dc235f7f | 884 | Congestion Windows Reduced. |
61bf6666 | 885 | .IP "\fB8: ns\fR" |
dc235f7f JR |
886 | Nonce Sum. |
887 | .IP "\fB9-11:\fR" | |
888 | Reserved. | |
889 | .IP "\fB12-15:\fR" | |
890 | Not matchable, must be zero. | |
891 | .RE | |
064af421 | 892 | .IP \fBicmp_type=\fItype\fR |
ed951f15 | 893 | .IQ \fBicmp_code=\fIcode\fR |
d31f1109 JP |
894 | When \fBdl_type\fR and \fBnw_proto\fR specify ICMP or ICMPv6, \fItype\fR |
895 | matches the ICMP type and \fIcode\fR matches the ICMP code. Each is | |
896 | specified as a decimal number between 0 and 255, inclusive. | |
ed951f15 BP |
897 | .IP |
898 | When \fBdl_type\fR and \fBnw_proto\fR take other values, the values of | |
0b3f2725 | 899 | these settings are ignored (see \fBFlow Syntax\fR above). |
71e17a7a | 900 | . |
6c1491fb | 901 | .IP \fBtable=\fInumber\fR |
0e197060 BP |
902 | For flow dump commands, limits the flows dumped to those in the table |
903 | with the given \fInumber\fR between 0 and 254. If not specified (or if | |
904 | 255 is specified as \fInumber\fR), then flows in all tables are | |
905 | dumped. | |
906 | . | |
907 | .IP | |
908 | For flow table modification commands, behavior varies based on the | |
909 | OpenFlow version used to connect to the switch: | |
910 | . | |
911 | .RS | |
912 | .IP "OpenFlow 1.0" | |
913 | OpenFlow 1.0 does not support \fBtable\fR for modifying flows. | |
914 | \fBovs\-ofctl\fR will exit with an error if \fBtable\fR (other than | |
915 | \fBtable=255\fR) is specified for a switch that only supports OpenFlow | |
916 | 1.0. | |
917 | .IP | |
918 | In OpenFlow 1.0, the switch chooses the table into which to insert a | |
919 | new flow. The Open vSwitch software switch always chooses table 0. | |
920 | Other Open vSwitch datapaths and other OpenFlow implementations may | |
921 | choose different tables. | |
922 | .IP | |
923 | The OpenFlow 1.0 behavior in Open vSwitch for modifying or removing | |
924 | flows depends on whether \fB\-\-strict\fR is used. Without | |
925 | \fB\-\-strict\fR, the command applies to matching flows in all tables. | |
926 | With \fB\-\-strict\fR, the command will operate on any single matching | |
927 | flow in any table; it will do nothing if there are matches in more | |
928 | than one table. (The distinction between these behaviors only matters | |
929 | if non-OpenFlow 1.0 commands were also used, because OpenFlow 1.0 | |
930 | alone cannot add flows with the same matching criteria to multiple | |
931 | tables.) | |
932 | . | |
933 | .IP "OpenFlow 1.0 with table_id extension" | |
934 | Open vSwitch implements an OpenFlow extension that allows the | |
935 | controller to specify the table on which to operate. \fBovs\-ofctl\fR | |
936 | automatically enables the extension when \fBtable\fR is specified and | |
937 | OpenFlow 1.0 is used. \fBovs\-ofctl\fR automatically detects whether | |
938 | the switch supports the extension. As of this writing, this extension | |
939 | is only known to be implemented by Open vSwitch. | |
940 | . | |
941 | .IP | |
942 | With this extension, \fBovs\-ofctl\fR operates on the requested table | |
943 | when \fBtable\fR is specified, and acts as described for OpenFlow 1.0 | |
944 | above when no \fBtable\fR is specified (or for \fBtable=255\fR). | |
945 | . | |
946 | .IP "OpenFlow 1.1" | |
947 | OpenFlow 1.1 requires flow table modification commands to specify a | |
948 | table. When \fBtable\fR is not specified (or \fBtable=255\fR is | |
949 | specified), \fBovs\-ofctl\fR defaults to table 0. | |
950 | . | |
951 | .IP "OpenFlow 1.2 and later" | |
952 | OpenFlow 1.2 and later allow flow deletion commands, but not other | |
953 | flow table modification commands, to operate on all flow tables, with | |
954 | the behavior described above for OpenFlow 1.0. | |
955 | .RE | |
6c1491fb | 956 | . |
54fa24c5 JS |
957 | .IP \fBmetadata=\fIvalue\fR[\fB/\fImask\fR] |
958 | Matches \fIvalue\fR either exactly or with optional \fImask\fR in the metadata | |
959 | field. \fIvalue\fR and \fImask\fR are 64-bit integers, by default in decimal | |
960 | (use a \fB0x\fR prefix to specify hexadecimal). Arbitrary \fImask\fR values | |
961 | are allowed: a 1-bit in \fImask\fR indicates that the corresponding bit in | |
962 | \fIvalue\fR must match exactly, and a 0-bit wildcards that bit. Matching on | |
963 | metadata was added in Open vSwitch 1.8. | |
964 | . | |
71e17a7a | 965 | .PP |
d31f1109 JP |
966 | The following shorthand notations are also available: |
967 | . | |
968 | .IP \fBip\fR | |
969 | Same as \fBdl_type=0x0800\fR. | |
970 | . | |
971 | .IP \fBicmp\fR | |
972 | Same as \fBdl_type=0x0800,nw_proto=1\fR. | |
973 | . | |
974 | .IP \fBtcp\fR | |
975 | Same as \fBdl_type=0x0800,nw_proto=6\fR. | |
976 | . | |
977 | .IP \fBudp\fR | |
978 | Same as \fBdl_type=0x0800,nw_proto=17\fR. | |
979 | . | |
0d56eaf2 JS |
980 | .IP \fBsctp\fR |
981 | Same as \fBdl_type=0x0800,nw_proto=132\fR. | |
982 | . | |
d31f1109 JP |
983 | .IP \fBarp\fR |
984 | Same as \fBdl_type=0x0806\fR. | |
985 | . | |
8087f5ff MM |
986 | .IP \fBrarp\fR |
987 | Same as \fBdl_type=0x8035\fR. | |
988 | . | |
d31f1109 | 989 | .PP |
71e17a7a JP |
990 | The following field assignments require support for the NXM (Nicira |
991 | Extended Match) extension to OpenFlow. When one of these is specified, | |
992 | \fBovs\-ofctl\fR will automatically attempt to negotiate use of this | |
993 | extension. If the switch does not support NXM, then \fBovs\-ofctl\fR | |
994 | will report a fatal error. | |
995 | . | |
33d8c6b4 BP |
996 | .IP \fBvlan_tci=\fItci\fR[\fB/\fImask\fR] |
997 | Matches modified VLAN TCI \fItci\fR. If \fImask\fR is omitted, | |
998 | \fItci\fR is the exact VLAN TCI to match; if \fImask\fR is specified, | |
a8600e1a | 999 | then a 1-bit in \fImask\fR indicates that the corresponding bit in |
33d8c6b4 BP |
1000 | \fItci\fR must match exactly, and a 0-bit wildcards that bit. Both |
1001 | \fItci\fR and \fImask\fR are 16-bit values that are decimal by | |
1002 | default; use a \fB0x\fR prefix to specify them in hexadecimal. | |
1003 | . | |
1004 | .IP | |
1005 | The value that \fBvlan_tci\fR matches against is 0 for a packet that | |
1006 | has no 802.1Q header. Otherwise, it is the TCI value from the 802.1Q | |
1007 | header with the CFI bit (with value \fB0x1000\fR) forced to 1. | |
1008 | .IP | |
1009 | Examples: | |
1010 | .RS | |
1011 | .IP \fBvlan_tci=0\fR | |
1012 | Match only packets without an 802.1Q header. | |
1013 | .IP \fBvlan_tci=0xf123\fR | |
1014 | Match packets tagged with priority 7 in VLAN 0x123. | |
1015 | .IP \fBvlan_tci=0x1123/0x1fff\fR | |
1016 | Match packets tagged with VLAN 0x123 (and any priority). | |
1017 | .IP \fBvlan_tci=0x5000/0xf000\fR | |
1018 | Match packets tagged with priority 2 (in any VLAN). | |
1019 | .IP \fBvlan_tci=0/0xfff\fR | |
1020 | Match packets with no 802.1Q header or tagged with VLAN 0 (and any | |
1021 | priority). | |
1022 | .IP \fBvlan_tci=0x5000/0xe000\fR | |
1023 | Match packets with no 802.1Q header or tagged with priority 2 (in any | |
1024 | VLAN). | |
1025 | .IP \fBvlan_tci=0/0xefff\fR | |
1026 | Match packets with no 802.1Q header or tagged with VLAN 0 and priority | |
1027 | 0. | |
1028 | .RE | |
1029 | .IP | |
1030 | Some of these matching possibilities can also be achieved with | |
1031 | \fBdl_vlan\fR and \fBdl_vlan_pcp\fR. | |
1032 | . | |
7257b535 BP |
1033 | .IP \fBip_frag=\fIfrag_type\fR |
1034 | When \fBdl_type\fR specifies IP or IPv6, \fIfrag_type\fR | |
1035 | specifies what kind of IP fragments or non-fragments to match. The | |
1036 | following values of \fIfrag_type\fR are supported: | |
1037 | .RS | |
1038 | .IP "\fBno\fR" | |
1039 | Matches only non-fragmented packets. | |
1040 | .IP "\fByes\fR" | |
1041 | Matches all fragments. | |
1042 | .IP "\fBfirst\fR" | |
1043 | Matches only fragments with offset 0. | |
1044 | .IP "\fBlater\fR" | |
1045 | Matches only fragments with nonzero offset. | |
1046 | .IP "\fBnot_later\fR" | |
1047 | Matches non-fragmented packets and fragments with zero offset. | |
1048 | .RE | |
1049 | .IP | |
1050 | The \fBip_frag\fR match type is likely to be most useful in | |
1051 | \fBnx\-match\fR mode. See the description of the \fBset\-frags\fR | |
1052 | command, above, for more details. | |
1053 | . | |
1e6fbba0 SH |
1054 | .IP \fBarp_spa=\fIip\fR[\fB/\fInetmask\fR] |
1055 | .IQ \fBarp_tpa=\fIip\fR[\fB/\fInetmask\fR] | |
1056 | When \fBdl_type\fR specifies either ARP or RARP, \fBarp_spa\fR and | |
e935fc32 | 1057 | \fBarp_tpa\fR match the source and target IPv4 address, respectively. |
1e6fbba0 SH |
1058 | An address may be specified as an IP address or host name |
1059 | (e.g. \fB192.168.1.1\fR or \fBwww.example.com\fR). The optional | |
1060 | \fInetmask\fR allows restricting a match to an IPv4 address prefix. | |
1061 | The netmask may be specified as a dotted quad | |
1062 | (e.g. \fB192.168.1.0/255.255.255.0\fR) or as a CIDR block | |
1063 | (e.g. \fB192.168.1.0/24\fR). | |
1064 | . | |
bad68a99 JP |
1065 | .IP \fBarp_sha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
1066 | .IQ \fBarp_tha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
8087f5ff MM |
1067 | When \fBdl_type\fR specifies either ARP or RARP, \fBarp_sha\fR and |
1068 | \fBarp_tha\fR match the source and target hardware address, respectively. An | |
9183708a SH |
1069 | address is specified as 6 pairs of hexadecimal digits delimited by colons |
1070 | (e.g. \fB00:0A:E4:25:6B:B0\fR). | |
bad68a99 | 1071 | . |
9183708a SH |
1072 | .IP \fBarp_sha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB/\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
1073 | .IQ \fBarp_tha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB/\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
1074 | When \fBdl_type\fR specifies either ARP or RARP, \fBarp_sha\fR and | |
1075 | \fBarp_tha\fR match the source and target hardware address, respectively. An | |
1076 | address is specified as 6 pairs of hexadecimal digits delimited by colons | |
1077 | (e.g. \fB00:0A:E4:25:6B:B0\fR), with a wildcard mask following the slash. | |
1078 | . | |
1079 | ||
d31f1109 JP |
1080 | .IP \fBipv6_src=\fIipv6\fR[\fB/\fInetmask\fR] |
1081 | .IQ \fBipv6_dst=\fIipv6\fR[\fB/\fInetmask\fR] | |
1082 | When \fBdl_type\fR is 0x86dd (possibly via shorthand, e.g., \fBipv6\fR | |
1083 | or \fBtcp6\fR), matches IPv6 source (or destination) address \fIipv6\fR, | |
1084 | which may be specified as defined in RFC 2373. The preferred format is | |
1085 | \fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fR, where | |
1086 | \fIx\fR are the hexadecimal values of the eight 16-bit pieces of the | |
1087 | address. A single instance of \fB::\fR may be used to indicate multiple | |
1088 | groups of 16-bits of zeros. The optional \fInetmask\fR allows | |
1089 | restricting a match to an IPv6 address prefix. A netmask is specified | |
ff0b06ee BP |
1090 | as an IPv6 address (e.g. \fB2001:db8:3c4d:1::/ffff:ffff:ffff:ffff::\fR) |
1091 | or a CIDR block (e.g. \fB2001:db8:3c4d:1::/64\fR). Open vSwitch 1.8 | |
1092 | and later support arbitrary masks; earlier versions support only CIDR | |
1093 | masks, that is, CIDR block and IPv6 addresses that are equivalent to | |
1094 | CIDR blocks. | |
d31f1109 | 1095 | . |
fa8223b7 JP |
1096 | .IP \fBipv6_label=\fIlabel\fR |
1097 | When \fBdl_type\fR is 0x86dd (possibly via shorthand, e.g., \fBipv6\fR | |
1098 | or \fBtcp6\fR), matches IPv6 flow label \fIlabel\fR. | |
1099 | . | |
47284b1f | 1100 | .IP \fBnd_target=\fIipv6\fR[\fB/\fInetmask\fR] |
685a51a5 JP |
1101 | When \fBdl_type\fR, \fBnw_proto\fR, and \fBicmp_type\fR specify |
1102 | IPv6 Neighbor Discovery (ICMPv6 type 135 or 136), matches the target address | |
1103 | \fIipv6\fR. \fIipv6\fR is in the same format described earlier for the | |
1104 | \fBipv6_src\fR and \fBipv6_dst\fR fields. | |
1105 | . | |
1106 | .IP \fBnd_sll=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
1107 | When \fBdl_type\fR, \fBnw_proto\fR, and \fBicmp_type\fR specify IPv6 | |
1108 | Neighbor Solicitation (ICMPv6 type 135), matches the source link\-layer | |
1109 | address option. An address is specified as 6 pairs of hexadecimal | |
1110 | digits delimited by colons. | |
1111 | . | |
1112 | .IP \fBnd_tll=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
1113 | When \fBdl_type\fR, \fBnw_proto\fR, and \fBicmp_type\fR specify IPv6 | |
1114 | Neighbor Advertisement (ICMPv6 type 136), matches the target link\-layer | |
1115 | address option. An address is specified as 6 pairs of hexadecimal | |
1116 | digits delimited by colons. | |
1117 | . | |
b4dca848 SH |
1118 | .IP \fBmpls_bos=\fIbos\fR |
1119 | When \fBdl_type\fR is 0x8847 or 0x8848 (possibly via shorthand e.g., | |
1120 | \fBmpls\fR or \fBmplsm\fR), matches the bottom-of-stack bit of the | |
1121 | outer-most MPLS label stack entry. Valid values are 0 and 1. | |
1122 | .IP | |
1123 | If 1 then for a packet with a well-formed MPLS label stack the | |
1124 | bottom-of-stack bit indicates that the outer label stack entry is also | |
1125 | the inner-most label stack entry and thus that is that there is only one | |
1126 | label stack entry present. Conversely, if 0 then for a packet with a | |
1127 | well-formed MPLS label stack the bottom-of-stack bit indicates that the | |
1128 | outer label stack entry is not the inner-most label stack entry and | |
1129 | thus there is more than one label stack entry present. | |
1130 | . | |
1131 | .IP \fBmpls_label=\fIlabel\fR | |
1132 | When \fBdl_type\fR is 0x8847 or 0x8848 (possibly via shorthand e.g., | |
1133 | \fBmpls\fR or \fBmplsm\fR), matches the label of the outer | |
1134 | MPLS label stack entry. The label is a 20-bit value that is decimal by default; | |
1135 | use a \fB0x\fR prefix to specify them in hexadecimal. | |
1136 | . | |
1137 | .IP \fBmpls_tc=\fItc\fR | |
1138 | When \fBdl_type\fR is 0x8847 or 0x8848 (possibly via shorthand e.g., | |
1139 | \fBmpls\fR or \fBmplsm\fR), matches the traffic-class of the outer | |
1140 | MPLS label stack entry. Valid values are between 0 (lowest) and 7 (highest). | |
1141 | . | |
8368c090 | 1142 | .IP \fBtun_id=\fItunnel-id\fR[\fB/\fImask\fR] |
44a7e26d | 1143 | .IQ \fBtunnel_id=\fItunnel-id\fR[\fB/\fImask\fR] |
8368c090 | 1144 | Matches tunnel identifier \fItunnel-id\fR. Only packets that arrive |
4c5df7f7 | 1145 | over a tunnel that carries a key (e.g. GRE with the RFC 2890 key |
bcb90943 SH |
1146 | extension and a nonzero key value) will have a nonzero tunnel ID. |
1147 | If \fImask\fR is omitted, \fItunnel-id\fR is the exact tunnel ID to match; | |
1148 | if \fImask\fR is specified, then a 1-bit in \fImask\fR indicates that the | |
1149 | corresponding bit in \fItunnel-id\fR must match exactly, and a 0-bit | |
1150 | wildcards that bit. | |
71e17a7a | 1151 | . |
0ad90c84 JR |
1152 | .IP \fBtun_src=\fIip\fR[\fB/\fInetmask\fR] |
1153 | .IQ \fBtun_dst=\fIip\fR[\fB/\fInetmask\fR] | |
1154 | Matches tunnel IPv4 source (or destination) address \fIip\fR. Only packets | |
1155 | that arrive over a tunnel will have nonzero tunnel addresses. | |
1156 | The address may be specified as an IP address or host name | |
1157 | (e.g. \fB192.168.1.1\fR or \fBwww.example.com\fR). The optional | |
1158 | \fInetmask\fR allows restricting a match to a masked IPv4 address. | |
1159 | The netmask may be specified as a dotted quad | |
1160 | (e.g. \fB192.168.1.0/255.255.255.0\fR) or as a CIDR block | |
1161 | (e.g. \fB192.168.1.0/24\fR). | |
1162 | . | |
ac6073e3 MC |
1163 | .IP \fBtun_gbp_id=\fIvalue\fR[\fB/\fImask\fR] |
1164 | .IQ \fBtun_gbp_flags=\fIvalue\fR[\fB/\fImask\fR] | |
1165 | Matches the group policy identifier and flags in the VXLAN header. Only | |
1166 | packets that arrive over a VXLAN tunnel with the "gbp" extension | |
1167 | enabled can have this field set. The fields may also be referred to by | |
1168 | NXM_NX_TUN_GBP_ID[] (16 bits) and NXM_NX_TUN_GBP_FLAGS[] (8 bits) in | |
1169 | the context of field manipulation actions. If these fields are set and | |
1170 | the packet matched by the flow is encapsulated in a VXLAN-GBP tunnel, | |
1171 | then the policy identifier and flags are transmitted to the destination | |
1172 | VXLAN tunnel endpoint. | |
1173 | .IP | |
1174 | The \fBtun_gbp_flags\fR field has the following format: | |
1175 | .IP | |
1176 | .in +2 | |
1177 | \f(CR+-+-+-+-+-+-+-+-+\fR | |
1178 | .br | |
1179 | \f(CR|-|D|-|-|A|-|-|-|\fR | |
1180 | .br | |
1181 | \f(CR+-+-+-+-+-+-+-+-+\fR | |
1182 | ||
1183 | .B D := | |
1184 | Don't Learn bit. When set, this bit indicates that the egress | |
1185 | tunnel endpoint MUST NOT learn the source address of the encapsulated | |
1186 | frame. | |
1187 | ||
1188 | .B A := | |
1189 | Indicates that the group policy has already been applied to | |
1190 | this packet. Policies MUST NOT be applied by devices when the A bit is | |
1191 | set. | |
1192 | .in -2 | |
1193 | .IP | |
1194 | For more information, please see the corresponding IETF draft: | |
1195 | https://tools.ietf.org/html/draft-smith-vxlan-group-policy | |
1196 | . | |
9558d2a5 JG |
1197 | .IP "\fBtun_metadata\fIidx\fB=\fIvalue\fR[\fB/\fImask\fR]" |
1198 | Matches \fIvalue\fR either exactly or with optional \fImask\fR in | |
1199 | tunnel metadata field number \fIidx\fR (numbered from 0 to 63). | |
1200 | Tunnel metadata fields can be dynamically assigned onto the data | |
1201 | contained in the options of Geneve packets using the commands | |
1202 | described in the section \fBOpenFlow Switch Geneve Option Table | |
1203 | Commands\fR. Once assigned, the length of the field is variable | |
1204 | according to the size of the option. Before updating a mapping in | |
1205 | the option table, flows with references to it should be removed, | |
1206 | otherwise the result is non-deterministic. | |
1207 | .IP | |
1208 | These fields were introduced in Open vSwitch 2.5. | |
1209 | . | |
00b1c62f BP |
1210 | .IP "\fBreg\fIidx\fB=\fIvalue\fR[\fB/\fImask\fR]" |
1211 | Matches \fIvalue\fR either exactly or with optional \fImask\fR in | |
1212 | register number \fIidx\fR. The valid range of \fIidx\fR depends on | |
1213 | the switch. \fIvalue\fR and \fImask\fR are 32-bit integers, by | |
1214 | default in decimal (use a \fB0x\fR prefix to specify hexadecimal). | |
1215 | Arbitrary \fImask\fR values are allowed: a 1-bit in \fImask\fR | |
1216 | indicates that the corresponding bit in \fIvalue\fR must match | |
1217 | exactly, and a 0-bit wildcards that bit. | |
1218 | .IP | |
1219 | When a packet enters an OpenFlow switch, all of the registers are set | |
79fe0f46 BP |
1220 | to 0. Only explicit actions change register values. |
1221 | . | |
1222 | .IP "\fBxreg\fIidx\fB=\fIvalue\fR[\fB/\fImask\fR]" | |
1223 | Matches \fIvalue\fR either exactly or with optional \fImask\fR in | |
1224 | 64-bit ``extended register'' number \fIidx\fR. Each of the 64-bit | |
1225 | extended registers overlays two of the 32-bit registers: \fBxreg0\fR | |
1226 | overlays \fBreg0\fR and \fBreg1\fR, with \fBreg0\fR supplying the | |
1227 | most-significant bits of \fBxreg0\fR and \fBreg1\fR the | |
5e0464a0 | 1228 | least-significant. \fBxreg1\fR similarly overlays \fBreg2\fR and |
79fe0f46 BP |
1229 | \fBreg3\fR, and so on. |
1230 | .IP | |
1231 | These fields were added in Open vSwitch 2.3 to conform with the | |
d3cb080e | 1232 | OpenFlow 1.5 specification. OpenFlow 1.5 calls these fields |
79fe0f46 BP |
1233 | just the ``packet registers,'' but Open vSwitch already had 32-bit |
1234 | registers by that name, which is why Open vSwitch refers to the | |
1235 | standard registers as ``extended registers''. | |
a9b4a41a | 1236 | . |
ac923e91 JG |
1237 | .IP \fBpkt_mark=\fIvalue\fR[\fB/\fImask\fR] |
1238 | Matches packet metadata mark \fIvalue\fR either exactly or with optional | |
1239 | \fImask\fR. The mark is associated data that may be passed into other | |
1240 | system components in order to facilitate interaction between subsystems. | |
1241 | On Linux this corresponds to the skb mark but the exact implementation is | |
1242 | platform-dependent. | |
1243 | . | |
c61f3870 BP |
1244 | .IP \fBactset_output=\fIport\fR |
1245 | Matches the output port currently in the OpenFlow action set, where | |
1246 | \fIport\fR may be an OpenFlow port number or keyword | |
1247 | (e.g. \fBLOCAL\fR). If there is no output port in the OpenFlow action | |
1248 | set, or if the output port will be ignored (e.g. because there is an | |
1249 | output group in the OpenFlow action set), then the value will be | |
1250 | \fBUNSET\fR. | |
1251 | .IP | |
1252 | This field was introduced in Open vSwitch 2.4 to conform with the | |
d3cb080e | 1253 | OpenFlow 1.5 specification. |
18080541 BP |
1254 | . |
1255 | .IP \fBconj_id=\fIvalue\fR | |
1256 | Matches the given 32-bit \fIvalue\fR against the conjunction ID. This | |
1257 | is used only with the \fBconjunction\fR action (see below). | |
1258 | .IP | |
1259 | This field was introduced in Open vSwitch 2.4. | |
1260 | . | |
064af421 | 1261 | .PP |
d31f1109 JP |
1262 | Defining IPv6 flows (those with \fBdl_type\fR equal to 0x86dd) requires |
1263 | support for NXM. The following shorthand notations are available for | |
1264 | IPv6-related flows: | |
a9b4a41a | 1265 | . |
d31f1109 JP |
1266 | .IP \fBipv6\fR |
1267 | Same as \fBdl_type=0x86dd\fR. | |
a9b4a41a | 1268 | . |
d31f1109 JP |
1269 | .IP \fBtcp6\fR |
1270 | Same as \fBdl_type=0x86dd,nw_proto=6\fR. | |
a9b4a41a | 1271 | . |
d31f1109 JP |
1272 | .IP \fBudp6\fR |
1273 | Same as \fBdl_type=0x86dd,nw_proto=17\fR. | |
a9b4a41a | 1274 | . |
0d56eaf2 JS |
1275 | .IP \fBsctp6\fR |
1276 | Same as \fBdl_type=0x86dd,nw_proto=132\fR. | |
1277 | . | |
d31f1109 JP |
1278 | .IP \fBicmp6\fR |
1279 | Same as \fBdl_type=0x86dd,nw_proto=58\fR. | |
a9b4a41a | 1280 | . |
064af421 | 1281 | .PP |
2c6d8411 BP |
1282 | Finally, field assignments to \fBduration\fR, \fBn_packets\fR, or |
1283 | \fBn_bytes\fR are ignored to allow output from the \fBdump\-flows\fR | |
1284 | command to be used as input for other commands that parse flows. | |
1285 | . | |
1286 | .PP | |
c821124b BP |
1287 | The \fBadd\-flow\fR, \fBadd\-flows\fR, and \fBmod\-flows\fR commands |
1288 | require an additional field, which must be the final field specified: | |
a9b4a41a | 1289 | . |
d1ba66e9 | 1290 | .IP \fBactions=\fR[\fIaction\fR][\fB,\fIaction\fR...]\fR |
064af421 | 1291 | Specifies a comma-separated list of actions to take on a packet when the |
d1ba66e9 BP |
1292 | flow entry matches. If no \fIaction\fR is specified, then packets |
1293 | matching the flow are dropped. The following forms of \fIaction\fR | |
1294 | are supported: | |
a9b4a41a | 1295 | . |
064af421 | 1296 | .RS |
d1ba66e9 BP |
1297 | .IP \fIport\fR |
1298 | .IQ \fBoutput:\fIport\fR | |
1299 | Outputs the packet to OpenFlow port number \fIport\fR. If \fIport\fR | |
1300 | is the packet's input port, the packet is not output. | |
c6100d92 BP |
1301 | . |
1302 | .IP \fBoutput:\fIsrc\fB[\fIstart\fB..\fIend\fB] | |
1303 | Outputs the packet to the OpenFlow port number read from \fIsrc\fR, | |
1304 | which must be an NXM field as described above. For example, | |
1305 | \fBoutput:NXM_NX_REG0[16..31]\fR outputs to the OpenFlow port number | |
d1ba66e9 BP |
1306 | written in the upper half of register 0. If the port number is the |
1307 | packet's input port, the packet is not output. | |
1308 | .IP | |
1309 | This form of \fBoutput\fR was added in Open vSwitch 1.3.0. This form | |
1310 | of \fBoutput\fR uses an OpenFlow extension that is not supported by | |
1311 | standard OpenFlow switches. | |
5682f723 | 1312 | . |
b47e67c4 TG |
1313 | .IP \fBgroup:\fIgroup_id\fR |
1314 | Outputs the packet to the OpenFlow group \fIgroup_id\fR. Group tables | |
1315 | are only supported in OpenFlow 1.1+. See Group Syntax for more details. | |
1316 | . | |
064af421 BP |
1317 | .IP \fBnormal\fR |
1318 | Subjects the packet to the device's normal L2/L3 processing. (This | |
1319 | action is not implemented by all OpenFlow switches.) | |
a9b4a41a | 1320 | . |
064af421 BP |
1321 | .IP \fBflood\fR |
1322 | Outputs the packet on all switch physical ports other than the port on | |
1323 | which it was received and any ports on which flooding is disabled | |
1324 | (typically, these would be ports disabled by the IEEE 802.1D spanning | |
1325 | tree protocol). | |
a9b4a41a | 1326 | . |
064af421 BP |
1327 | .IP \fBall\fR |
1328 | Outputs the packet on all switch physical ports other than the port on | |
1329 | which it was received. | |
a9b4a41a | 1330 | . |
d1ba66e9 BP |
1331 | .IP \fBlocal\fR |
1332 | Outputs the packet on the ``local port,'' which corresponds to the | |
1333 | network device that has the same name as the bridge. | |
1334 | . | |
1335 | .IP \fBin_port\fR | |
1336 | Outputs the packet on the port from which it was received. | |
1337 | . | |
a7349929 | 1338 | .IP \fBcontroller(\fIkey\fB=\fIvalue\fR...\fB) |
064af421 | 1339 | Sends the packet to the OpenFlow controller as a ``packet in'' |
a7349929 BP |
1340 | message. The supported key-value pairs are: |
1341 | .RS | |
1342 | .IP "\fBmax_len=\fInbytes\fR" | |
1343 | Limit to \fInbytes\fR the number of bytes of the packet to send to | |
1344 | the controller. By default the entire packet is sent. | |
1345 | .IP "\fBreason=\fIreason\fR" | |
1346 | Specify \fIreason\fR as the reason for sending the message in the | |
1347 | ``packet in'' message. The supported reasons are \fBaction\fR (the | |
1348 | default), \fBno_match\fR, and \fBinvalid_ttl\fR. | |
1349 | .IP "\fBid=\fIcontroller-id\fR" | |
1350 | Specify \fIcontroller-id\fR, a 16-bit integer, as the connection ID of | |
1351 | the OpenFlow controller or controllers to which the ``packet in'' | |
1352 | message should be sent. The default is zero. Zero is also the | |
1353 | default connection ID for each controller connection, and a given | |
1354 | controller connection will only have a nonzero connection ID if its | |
1355 | controller uses the \fBNXT_SET_CONTROLLER_ID\fR Nicira extension to | |
1356 | OpenFlow. | |
1357 | .RE | |
d1ba66e9 | 1358 | .IP |
a7349929 BP |
1359 | Any \fIreason\fR other than \fBaction\fR and any nonzero |
1360 | \fIcontroller-id\fR uses a Nicira vendor extension that, as of this | |
1361 | writing, is only known to be implemented by Open vSwitch (version 1.6 | |
1362 | or later). | |
1363 | . | |
1364 | .IP \fBcontroller\fR | |
1365 | .IQ \fBcontroller\fR[\fB:\fInbytes\fR] | |
1366 | Shorthand for \fBcontroller()\fR or | |
1367 | \fBcontroller(max_len=\fInbytes\fB)\fR, respectively. | |
a9b4a41a | 1368 | . |
d1ba66e9 BP |
1369 | .IP \fBenqueue(\fIport\fB,\fIqueue\fB)\fR |
1370 | Enqueues the packet on the specified \fIqueue\fR within port | |
1371 | \fIport\fR, which must be an OpenFlow port number or keyword | |
1372 | (e.g. \fBLOCAL\fR). The number of supported queues depends on the | |
1373 | switch; some OpenFlow implementations do not support queuing at all. | |
64c1e8af | 1374 | . |
064af421 BP |
1375 | .IP \fBdrop\fR |
1376 | Discards the packet, so no further processing or forwarding takes place. | |
1377 | If a drop action is used, no other actions may be specified. | |
a9b4a41a | 1378 | . |
064af421 BP |
1379 | .IP \fBmod_vlan_vid\fR:\fIvlan_vid\fR |
1380 | Modifies the VLAN id on a packet. The VLAN tag is added or modified | |
1381 | as necessary to match the value specified. If the VLAN tag is added, | |
1382 | a priority of zero is used (see the \fBmod_vlan_pcp\fR action to set | |
1383 | this). | |
a9b4a41a | 1384 | . |
064af421 BP |
1385 | .IP \fBmod_vlan_pcp\fR:\fIvlan_pcp\fR |
1386 | Modifies the VLAN priority on a packet. The VLAN tag is added or modified | |
1387 | as necessary to match the value specified. Valid values are between 0 | |
1388 | (lowest) and 7 (highest). If the VLAN tag is added, a vid of zero is used | |
1389 | (see the \fBmod_vlan_vid\fR action to set this). | |
a9b4a41a | 1390 | . |
064af421 BP |
1391 | .IP \fBstrip_vlan\fR |
1392 | Strips the VLAN tag from a packet if it is present. | |
a9b4a41a | 1393 | . |
3e34fbdd IY |
1394 | .IP \fBpush_vlan\fR:\fIethertype\fR |
1395 | Push a new VLAN tag onto the packet. Ethertype is used as the the Ethertype | |
1396 | for the tag. Only ethertype 0x8100 should be used. (0x88a8 which the spec | |
1397 | allows isn't supported at the moment.) | |
1398 | A priority of zero and the tag of zero are used for the new tag. | |
1399 | . | |
b02475c5 | 1400 | .IP \fBpush_mpls\fR:\fIethertype\fR |
912c1938 SH |
1401 | Changes the packet's Ethertype to \fIethertype\fR, which must be either |
1402 | \fB0x8847\fR or \fB0x8848\fR, and pushes an MPLS LSE. | |
1403 | .IP | |
1404 | If the packet does not already contain any MPLS labels then an initial | |
1405 | label stack entry is pushed. The label stack entry's label is 2 if the | |
1406 | packet contains IPv6 and 0 otherwise, its default traffic control value is | |
1407 | the low 3 bits of the packet's DSCP value (0 if the packet is not IP), and | |
1408 | its TTL is copied from the IP TTL (64 if the packet is not IP). | |
b02475c5 SH |
1409 | .IP |
1410 | If the packet does already contain an MPLS label, pushes a new | |
1411 | outermost label as a copy of the existing outermost label. | |
1412 | .IP | |
b0a17866 SH |
1413 | A limitation of the implementation is that processing of actions will stop |
1414 | if \fBpush_mpls\fR follows another \fBpush_mpls\fR unless there is a | |
1415 | \fBpop_mpls\fR in between. | |
b02475c5 SH |
1416 | . |
1417 | .IP \fBpop_mpls\fR:\fIethertype\fR | |
799a91bb SH |
1418 | Strips the outermost MPLS label stack entry. |
1419 | Currently the implementation restricts \fIethertype\fR to a non-MPLS Ethertype | |
1420 | and thus \fBpop_mpls\fR should only be applied to packets with | |
b0a17866 SH |
1421 | an MPLS label stack depth of one. A further limitation is that processing of |
1422 | actions will stop if \fBpop_mpls\fR follows another \fBpop_mpls\fR unless | |
1423 | there is a \fBpush_mpls\fR in between. | |
b02475c5 | 1424 | . |
064af421 BP |
1425 | .IP \fBmod_dl_src\fB:\fImac\fR |
1426 | Sets the source Ethernet address to \fImac\fR. | |
a9b4a41a | 1427 | . |
064af421 BP |
1428 | .IP \fBmod_dl_dst\fB:\fImac\fR |
1429 | Sets the destination Ethernet address to \fImac\fR. | |
a9b4a41a | 1430 | . |
e423eca6 JP |
1431 | .IP \fBmod_nw_src\fB:\fIip\fR |
1432 | Sets the IPv4 source address to \fIip\fR. | |
a9b4a41a | 1433 | . |
e423eca6 JP |
1434 | .IP \fBmod_nw_dst\fB:\fIip\fR |
1435 | Sets the IPv4 destination address to \fIip\fR. | |
a9b4a41a | 1436 | . |
e423eca6 | 1437 | .IP \fBmod_tp_src\fB:\fIport\fR |
0d56eaf2 | 1438 | Sets the TCP or UDP or SCTP source port to \fIport\fR. |
a9b4a41a | 1439 | . |
e423eca6 | 1440 | .IP \fBmod_tp_dst\fB:\fIport\fR |
0d56eaf2 | 1441 | Sets the TCP or UDP or SCTP destination port to \fIport\fR. |
a9b4a41a | 1442 | . |
959a2ecd | 1443 | .IP \fBmod_nw_tos\fB:\fItos\fR |
04f01c24 BP |
1444 | Sets the DSCP bits in the IPv4 ToS/DSCP or IPv6 traffic class field to |
1445 | \fItos\fR, which must be a multiple of 4 between 0 and 255. This action | |
1446 | does not modify the two least significant bits of the ToS field (the ECN bits). | |
ff14eb7a JR |
1447 | . |
1448 | .IP \fBmod_nw_ecn\fB:\fIecn\fR | |
1449 | Sets the ECN bits in the IPv4 ToS or IPv6 traffic class field to \fIecn\fR, | |
1450 | which must be a value between 0 and 3, inclusive. This action does not modify | |
1451 | the six most significant bits of the field (the DSCP bits). | |
1452 | .IP | |
1453 | Requires OpenFlow 1.1 or later. | |
0c20dbe4 JR |
1454 | . |
1455 | .IP \fBmod_nw_ttl\fB:\fIttl\fR | |
1456 | Sets the IPv4 TTL or IPv6 hop limit field to \fIttl\fR, which is specified as | |
1457 | a decimal number between 0 and 255, inclusive. Switch behavior when setting | |
1458 | \fIttl\fR to zero is not well specified, though. | |
1459 | .IP | |
1460 | Requires OpenFlow 1.1 or later. | |
659586ef JG |
1461 | .RE |
1462 | .IP | |
1463 | The following actions are Nicira vendor extensions that, as of this writing, are | |
1464 | only known to be implemented by Open vSwitch: | |
1465 | . | |
1466 | .RS | |
1467 | . | |
3a2fe1f3 | 1468 | .IP \fBresubmit\fB:\fIport\fR |
29901626 BP |
1469 | .IQ \fBresubmit\fB(\fR[\fIport\fR]\fB,\fR[\fItable\fR]\fB) |
1470 | Re-searches this OpenFlow flow table (or the table whose number is | |
1471 | specified by \fItable\fR) with the \fBin_port\fR field replaced by | |
1472 | \fIport\fR (if \fIport\fR is specified) and executes the actions | |
1473 | found, if any, in addition to any other actions in this flow entry. | |
1474 | .IP | |
1475 | Recursive \fBresubmit\fR actions are obeyed up to an | |
1476 | implementation-defined maximum depth. Open vSwitch 1.0.1 and earlier | |
1477 | did not support recursion; Open vSwitch before 1.2.90 did not support | |
1478 | \fItable\fR. | |
659586ef JG |
1479 | . |
1480 | .IP \fBset_tunnel\fB:\fIid\fR | |
b9298d3f BP |
1481 | .IQ \fBset_tunnel64\fB:\fIid\fR |
1482 | If outputting to a port that encapsulates the packet in a tunnel and | |
5a6861aa | 1483 | supports an identifier (such as GRE), sets the identifier to \fIid\fR. |
b9298d3f BP |
1484 | If the \fBset_tunnel\fR form is used and \fIid\fR fits in 32 bits, |
1485 | then this uses an action extension that is supported by Open vSwitch | |
1486 | 1.0 and later. Otherwise, if \fIid\fR is a 64-bit value, it requires | |
1487 | Open vSwitch 1.1 or later. | |
3a2fe1f3 | 1488 | . |
eedc0097 JP |
1489 | .IP \fBset_queue\fB:\fIqueue\fR |
1490 | Sets the queue that should be used to \fIqueue\fR when packets are | |
1491 | output. The number of supported queues depends on the switch; some | |
1492 | OpenFlow implementations do not support queuing at all. | |
1493 | . | |
1494 | .IP \fBpop_queue\fR | |
1495 | Restores the queue to the value it was before any \fBset_queue\fR | |
1496 | actions were applied. | |
1497 | . | |
f0fd1a17 | 1498 | .IP \fBdec_ttl\fR |
c2d967a5 | 1499 | .IQ \fBdec_ttl\fB[\fR(\fIid1,id2\fI)\fR]\fR |
f0fd1a17 | 1500 | Decrement TTL of IPv4 packet or hop limit of IPv6 packet. If the |
972b5f38 JR |
1501 | TTL or hop limit is initially zero or decrementing would make it so, no |
1502 | decrement occurs, as packets reaching TTL zero must be rejected. Instead, | |
f0fd1a17 PS |
1503 | a ``packet-in'' message with reason code \fBOFPR_INVALID_TTL\fR is |
1504 | sent to each connected controller that has enabled receiving them, | |
c2d967a5 MM |
1505 | if any. Processing the current set of actions then stops. However, |
1506 | if the current set of actions was reached through ``resubmit'' then | |
1507 | remaining actions in outer levels resume processing. This action | |
1508 | also optionally supports the ability to specify a list of valid | |
1509 | controller ids. Each of controllers in the list will receive the | |
1510 | ``packet_in'' message only if they have registered to receive the | |
1511 | invalid ttl packets. If controller ids are not specified, the | |
1512 | ``packet_in'' message will be sent only to the controllers having | |
1513 | controller id zero which have registered for the invalid ttl packets. | |
f0fd1a17 | 1514 | . |
afd5ac06 SH |
1515 | .IP \fBset_mpls_label\fR:\fIlabel\fR |
1516 | Set the label of the outer MPLS label stack entry of a packet. | |
1517 | \fIlabel\fR should be a 20-bit value that is decimal by default; | |
1518 | use a \fB0x\fR prefix to specify them in hexadecimal. | |
1519 | . | |
1520 | .IP \fBset_mpls_tc\fR:\fItc\fR | |
1521 | Set the traffic-class of the outer MPLS label stack entry of a packet. | |
1522 | \fItc\fR should be a in the range 0 to 7 inclusive. | |
1523 | . | |
0f3f3c3d SH |
1524 | .IP \fBset_mpls_ttl\fR:\fIttl\fR |
1525 | Set the TTL of the outer MPLS label stack entry of a packet. | |
1526 | \fIttl\fR should be in the range 0 to 255 inclusive. | |
1527 | . | |
b676167a SH |
1528 | .IP \fBdec_mpls_ttl\fR |
1529 | Decrement TTL of the outer MPLS label stack entry of a packet. If the TTL | |
972b5f38 JR |
1530 | is initially zero or decrementing would make it so, no decrement occurs. |
1531 | Instead, a ``packet-in'' message with reason code \fBOFPR_INVALID_TTL\fR | |
1532 | is sent to the main controller (id zero), if it has enabled receiving them. | |
b676167a SH |
1533 | Processing the current set of actions then stops. However, if the current |
1534 | set of actions was reached through ``resubmit'' then remaining actions in | |
1535 | outer levels resume processing. | |
1536 | . | |
96fc46e8 BP |
1537 | .IP \fBnote:\fR[\fIhh\fR]... |
1538 | Does nothing at all. Any number of bytes represented as hex digits | |
1539 | \fIhh\fR may be included. Pairs of hex digits may be separated by | |
1540 | periods for readability. | |
e0631927 BP |
1541 | The \fBnote\fR action's format doesn't include an exact length for its |
1542 | payload, so the provided bytes will be padded on the right by enough | |
1543 | bytes with value 0 to make the total number 6 more than a multiple of | |
1544 | 8. | |
f393f81e | 1545 | . |
5a6861aa | 1546 | .IP "\fBmove:\fIsrc\fB[\fIstart\fB..\fIend\fB]\->\fIdst\fB[\fIstart\fB..\fIend\fB]\fR" |
f393f81e BP |
1547 | Copies the named bits from field \fIsrc\fR to field \fIdst\fR. |
1548 | \fIsrc\fR and \fIdst\fR must be NXM field names as defined in | |
1549 | \fBnicira\-ext.h\fR, e.g. \fBNXM_OF_UDP_SRC\fR or \fBNXM_NX_REG0\fR. | |
1550 | Each \fIstart\fR and \fIend\fR pair, which are inclusive, must specify | |
1551 | the same number of bits and must fit within its respective field. | |
1552 | Shorthands for \fB[\fIstart\fB..\fIend\fB]\fR exist: use | |
1553 | \fB[\fIbit\fB]\fR to specify a single bit or \fB[]\fR to specify an | |
1554 | entire field. | |
1555 | .IP | |
1556 | Examples: \fBmove:NXM_NX_REG0[0..5]\->NXM_NX_REG1[26..31]\fR copies the | |
1557 | six bits numbered 0 through 5, inclusive, in register 0 into bits 26 | |
1558 | through 31, inclusive; | |
5a6861aa | 1559 | \fBmove:NXM_NX_REG0[0..15]\->NXM_OF_VLAN_TCI[]\fR copies the least |
f393f81e | 1560 | significant 16 bits of register 0 into the VLAN TCI field. |
1a12c419 | 1561 | .IP |
914624f8 BP |
1562 | In OpenFlow 1.0 through 1.4, \fBmove\fR ordinarily uses an Open |
1563 | vSwitch extension to OpenFlow. In OpenFlow 1.5, \fBmove\fR uses the | |
d3cb080e | 1564 | OpenFlow 1.5 standard \fBcopy_field\fR action. The ONF has |
914624f8 BP |
1565 | also made \fBcopy_field\fR available as an extension to OpenFlow 1.3. |
1566 | Open vSwitch 2.4 and later understands this extension and uses it if a | |
1567 | controller uses it, but for backward compatibility with older versions | |
1568 | of Open vSwitch, \fBovs\-ofctl\fR does not use it. | |
f393f81e | 1569 | . |
7eb4b1f1 BP |
1570 | .IP "\fBset_field:\fIvalue\fR[/\fImask\fR]\fB\->\fIdst" |
1571 | .IQ "\fBload:\fIvalue\fB\->\fIdst\fB[\fIstart\fB..\fIend\fB]" | |
1572 | Loads a literal value into a field or part of a field. With | |
1573 | \fBset_field\fR, \fBvalue\fR and the optional \fBmask\fR are given in | |
1574 | the customary syntax for field \fIdst\fR, which is expressed as a | |
1575 | field name. For example, \fBset_field:00:11:22:33:44:55->eth_src\fR | |
1576 | sets the Ethernet source address to 00:11:22:33:44:55. With | |
1577 | \fBload\fR, \fIvalue\fR must be an integer value (in decimal or | |
1578 | prefixed by \fB0x\fR for hexadecimal) and \fIdst\fR is the NXM or OXM | |
1579 | name for the field. For example, | |
1580 | \fBload:0x001122334455->OXM_OF_ETH_DST[]\fR has the same effect as the | |
1581 | prior \fBset_field\fR example. | |
1582 | .IP | |
1583 | The two forms exist for historical reasons. Open vSwitch 1.1 | |
1584 | introduced \fBNXAST_REG_LOAD\fR as a Nicira extension to OpenFlow 1.0 | |
1585 | and used \fBload\fR to express it. Later, OpenFlow 1.2 introduced a | |
1586 | standard \fBOFPAT_SET_FIELD\fR action that was restricted to loading | |
1587 | entire fields, so Open vSwitch added the form \fBset_field\fR with | |
1588 | this restriction. OpenFlow 1.5 extended \fBOFPAT_SET_FIELD\fR to the | |
1589 | point that it became a superset of \fBNXAST_REG_LOAD\fR. Open vSwitch | |
1590 | translates either syntax as necessary for the OpenFlow version in use: | |
1591 | in OpenFlow 1.0 and 1.1, \fBNXAST_REG_LOAD\fR; in OpenFlow 1.2, 1.3, | |
1592 | and 1.4, \fBNXAST_REG_LOAD\fR for \fBload\fR or for loading a | |
1593 | subfield, \fBOFPAT_SET_FIELD\fR otherwise; and OpenFlow 1.5 and later, | |
1594 | \fBOFPAT_SET_FIELD\fR. | |
53ddd40a | 1595 | . |
bd85dac1 AZ |
1596 | .IP "\fBpush:\fIsrc\fB[\fIstart\fB..\fIend\fB]" |
1597 | Pushes \fIstart\fR to \fIend\fR bits inclusive, in fields | |
1598 | on top of the stack. | |
1599 | .IP | |
1600 | Example: \fBpush:NXM_NX_REG2[0..5]\fR push the value stored in register | |
1601 | 2 bits 0 through 5, inclusive, on to the internal stack. | |
1602 | . | |
1603 | .IP "\fBpop:\fIdst\fB[\fIstart\fB..\fIend\fB]" | |
1604 | Pops from the top of the stack, retrieves the \fIstart\fR to \fIend\fR bits | |
1605 | inclusive, from the value popped and store them into the corresponding | |
1606 | bits in \fIdst\fR. | |
1607 | . | |
1608 | .IP | |
1609 | Example: \fBpop:NXM_NX_REG2[0..5]\fR pops the value from top of the stack. | |
1610 | Set register 2 bits 0 through 5, inclusive, based on bits 0 through 5 from the | |
1611 | value just popped. | |
1612 | . | |
f5c45121 | 1613 | . |
53ddd40a BP |
1614 | .IP "\fBmultipath(\fIfields\fB, \fIbasis\fB, \fIalgorithm\fB, \fIn_links\fB, \fIarg\fB, \fIdst\fB[\fIstart\fB..\fIend\fB])\fR" |
1615 | Hashes \fIfields\fR using \fIbasis\fR as a universal hash parameter, | |
1616 | then the applies multipath link selection \fIalgorithm\fR (with | |
1617 | parameter \fIarg\fR) to choose one of \fIn_links\fR output links | |
1618 | numbered 0 through \fIn_links\fR minus 1, and stores the link into | |
43edca57 | 1619 | \fIdst\fB[\fIstart\fB..\fIend\fB]\fR, which must be an NXM field as |
53ddd40a BP |
1620 | described above. |
1621 | .IP | |
4249b547 JB |
1622 | \fIfields\fR must be one of the following: |
1623 | .RS | |
1624 | .IP \fBeth_src\fR | |
1625 | Hashes Ethernet source address only. | |
1626 | .IP \fBsymmetric_l4\fR | |
1627 | Hashes Ethernet source, destination, and type, VLAN ID, IPv4/IPv6 | |
1628 | source, destination, and protocol, and TCP or SCTP (but not UDP) | |
1629 | ports. The hash is computed so that pairs of corresponding flows in | |
1630 | each direction hash to the same value, in environments where L2 paths | |
1631 | are the same in each direction. UDP ports are not included in the | |
1632 | hash to support protocols such as VXLAN that use asymmetric ports in | |
1633 | each direction. | |
1634 | .IP \fBsymmetric_l3l4\fR | |
1635 | Hashes IPv4/IPv6 source, destination, and protocol, and TCP or SCTP | |
1636 | (but not UDP) ports. Like \fBsymmetric_l4\fR, this is a symmetric | |
1637 | hash, but by excluding L2 headers it is more effective in environments | |
1638 | with asymmetric L2 paths (e.g. paths involving VRRP IP addresses on a | |
1639 | router). Not an effective hash function for protocols other than IPv4 | |
1640 | and IPv6, which hash to a constant zero. | |
1641 | .IP \fBsymmetric_l3l4+udp\fR | |
1642 | Like \fBsymmetric_l3l4+udp\fR, but UDP ports are included in the hash. | |
1643 | This is a more effective hash when asymmetric UDP protocols such as | |
1644 | VXLAN are not a consideration. | |
1645 | .RE | |
1646 | .IP | |
1647 | \fIalgorithm\fR must be one of \fBmodulo_n\fR, | |
53ddd40a BP |
1648 | \fBhash_threshold\fR, \fBhrw\fR, and \fBiter_hash\fR. Only |
1649 | the \fBiter_hash\fR algorithm uses \fIarg\fR. | |
1650 | .IP | |
1651 | Refer to \fBnicira\-ext.h\fR for more details. | |
3b6a2571 | 1652 | . |
daff3353 EJ |
1653 | .IP "\fBbundle(\fIfields\fB, \fIbasis\fB, \fIalgorithm\fB, \fIslave_type\fB, slaves:[\fIs1\fB, \fIs2\fB, ...])\fR" |
1654 | Hashes \fIfields\fR using \fIbasis\fR as a universal hash parameter, then | |
1655 | applies the bundle link selection \fIalgorithm\fR to choose one of the listed | |
1656 | slaves represented as \fIslave_type\fR. Currently the only supported | |
1657 | \fIslave_type\fR is \fBofport\fR. Thus, each \fIs1\fR through \fIsN\fR should | |
1658 | be an OpenFlow port number. Outputs to the selected slave. | |
1659 | .IP | |
4249b547 JB |
1660 | Currently, \fIfields\fR must be either \fBeth_src\fR, \fBsymmetric_l4\fR, \fBsymmetric_l3l4\fR, or \fBsymmetric_l3l4+udp\fR, |
1661 | and \fIalgorithm\fR must be one of \fBhrw\fR and \fBactive_backup\fR. | |
daff3353 EJ |
1662 | .IP |
1663 | Example: \fBbundle(eth_src,0,hrw,ofport,slaves:4,8)\fR uses an Ethernet source | |
1664 | hash with basis 0, to select between OpenFlow ports 4 and 8 using the Highest | |
1665 | Random Weight algorithm. | |
1666 | .IP | |
1667 | Refer to \fBnicira\-ext.h\fR for more details. | |
a368bb53 EJ |
1668 | . |
1669 | .IP "\fBbundle_load(\fIfields\fB, \fIbasis\fB, \fIalgorithm\fB, \fIslave_type\fB, \fIdst\fB[\fIstart\fB..\fIend\fB], slaves:[\fIs1\fB, \fIs2\fB, ...])\fR" | |
1670 | Has the same behavior as the \fBbundle\fR action, with one exception. Instead | |
1671 | of outputting to the selected slave, it writes its selection to | |
1672 | \fIdst\fB[\fIstart\fB..\fIend\fB]\fR, which must be an NXM field as described | |
1673 | above. | |
1674 | .IP | |
2638c6dc BP |
1675 | Example: \fBbundle_load(eth_src, 0, hrw, ofport, NXM_NX_REG0[], |
1676 | slaves:4, 8)\fR uses an Ethernet source hash with basis 0, to select | |
1677 | between OpenFlow ports 4 and 8 using the Highest Random Weight | |
1678 | algorithm, and writes the selection to \fBNXM_NX_REG0[]\fR. | |
a368bb53 EJ |
1679 | .IP |
1680 | Refer to \fBnicira\-ext.h\fR for more details. | |
75a75043 BP |
1681 | . |
1682 | .IP "\fBlearn(\fIargument\fR[\fB,\fIargument\fR]...\fB)\fR" | |
1683 | This action adds or modifies a flow in an OpenFlow table, similar to | |
1684 | \fBovs\-ofctl \-\-strict mod\-flows\fR. The arguments specify the | |
1685 | flow's match fields, actions, and other properties, as follows. At | |
1686 | least one match criterion and one action argument should ordinarily be | |
1687 | specified. | |
1688 | .RS | |
1689 | .IP \fBidle_timeout=\fIseconds\fR | |
1690 | .IQ \fBhard_timeout=\fIseconds\fR | |
1691 | .IQ \fBpriority=\fIvalue\fR | |
45d77538 | 1692 | .IQ \fBcookie=\fIvalue\fR |
3d6832c2 BP |
1693 | .IQ \fBsend_flow_rem\fR |
1694 | These arguments have the same meaning as in the usual \fBovs\-ofctl\fR | |
1695 | flow syntax. | |
75a75043 | 1696 | . |
0e553d9c BP |
1697 | .IP \fBfin_idle_timeout=\fIseconds\fR |
1698 | .IQ \fBfin_hard_timeout=\fIseconds\fR | |
1699 | Adds a \fBfin_timeout\fR action with the specified arguments to the | |
1700 | new flow. This feature was added in Open vSwitch 1.5.90. | |
1701 | . | |
75a75043 BP |
1702 | .IP \fBtable=\fInumber\fR |
1703 | The table in which the new flow should be inserted. Specify a decimal | |
1704 | number between 0 and 254. The default, if \fBtable\fR is unspecified, | |
1705 | is table 1. | |
1706 | . | |
35f48b8b BP |
1707 | .IP \fBdelete_learned\fR |
1708 | This flag enables deletion of the learned flows when the flow with the | |
1709 | \fBlearn\fR action is removed. Specifically, when the last | |
1710 | \fBlearn\fR action with this flag and particular \fBtable\fR and | |
1711 | \fBcookie\fR values is removed, the switch deletes all of the flows in | |
1712 | the specified table with the specified cookie. | |
1713 | . | |
1714 | .IP | |
1715 | This flag was added in Open vSwitch 2.4. | |
1716 | . | |
75a75043 BP |
1717 | .IP \fIfield\fB=\fIvalue\fR |
1718 | .IQ \fIfield\fB[\fIstart\fB..\fIend\fB]=\fIsrc\fB[\fIstart\fB..\fIend\fB]\fR | |
1719 | .IQ \fIfield\fB[\fIstart\fB..\fIend\fB]\fR | |
1720 | Adds a match criterion to the new flow. | |
1721 | .IP | |
1722 | The first form specifies that \fIfield\fR must match the literal | |
1723 | \fIvalue\fR, e.g. \fBdl_type=0x0800\fR. All of the fields and values | |
1724 | for \fBovs\-ofctl\fR flow syntax are available with their usual | |
1725 | meanings. | |
1726 | .IP | |
1727 | The second form specifies that \fIfield\fB[\fIstart\fB..\fIend\fB]\fR | |
1728 | in the new flow must match \fIsrc\fB[\fIstart\fB..\fIend\fB]\fR taken | |
1729 | from the flow currently being processed. | |
1730 | .IP | |
1731 | The third form is a shorthand for the second form. It specifies that | |
1732 | \fIfield\fB[\fIstart\fB..\fIend\fB]\fR in the new flow must match | |
1733 | \fIfield\fB[\fIstart\fB..\fIend\fB]\fR taken from the flow currently | |
1734 | being processed. | |
1735 | . | |
1736 | .IP \fBload:\fIvalue\fB\->\fIdst\fB[\fIstart\fB..\fIend\fB] | |
1737 | .IQ \fBload:\fIsrc\fB[\fIstart\fB..\fIend\fB]\->\fIdst\fB[\fIstart\fB..\fIend\fB] | |
1738 | . | |
1739 | Adds a \fBload\fR action to the new flow. | |
1740 | .IP | |
1741 | The first form loads the literal \fIvalue\fR into bits \fIstart\fR | |
1742 | through \fIend\fR, inclusive, in field \fIdst\fR. Its syntax is the | |
1743 | same as the \fBload\fR action described earlier in this section. | |
1744 | .IP | |
1745 | The second form loads \fIsrc\fB[\fIstart\fB..\fIend\fB]\fR, a value | |
1746 | from the flow currently being processed, into bits \fIstart\fR | |
1747 | through \fIend\fR, inclusive, in field \fIdst\fR. | |
1748 | . | |
1749 | .IP \fBoutput:\fIfield\fB[\fIstart\fB..\fIend\fB]\fR | |
1750 | Add an \fBoutput\fR action to the new flow's actions, that outputs to | |
1751 | the OpenFlow port taken from \fIfield\fB[\fIstart\fB..\fIend\fB]\fR, | |
1752 | which must be an NXM field as described above. | |
1753 | .RE | |
1754 | .IP | |
1755 | For best performance, segregate learned flows into a table (using | |
1756 | \fBtable=\fInumber\fR) that is not used for any other flows except | |
1757 | possibly for a lowest-priority ``catch-all'' flow, that is, a flow | |
1758 | with no match criteria. (This is why the default \fBtable\fR is 1, to | |
1759 | keep the learned flows separate from the primary flow table 0.) | |
c4f5d00b | 1760 | .RE |
a9b4a41a | 1761 | . |
8dd54666 | 1762 | .RS |
8dd54666 | 1763 | . |
b19e8793 IY |
1764 | .IP \fBclear_actions\fR |
1765 | Clears all the actions in the action set immediately. | |
1766 | . | |
7fdb60a7 SH |
1767 | .IP \fBwrite_actions(\fR[\fIaction\fR][\fB,\fIaction\fR...]\fB) |
1768 | Add the specific actions to the action set. The syntax of | |
1769 | \fIactions\fR is the same as in the \fBactions=\fR field. The action | |
1770 | set is carried between flow tables and then executed at the end of the | |
1771 | pipeline. | |
1772 | . | |
1773 | .IP | |
1774 | The actions in the action set are applied in the following order, as | |
1775 | required by the OpenFlow specification, regardless of the order in | |
1776 | which they were added to the action set. Except as specified | |
1777 | otherwise below, the action set only holds at most a single action of | |
1778 | each type. When more than one action of a single type is written to | |
1779 | the action set, the one written later replaces the earlier action: | |
1780 | . | |
1781 | .RS | |
1782 | .IP 1. | |
1783 | \fBstrip_vlan\fR | |
1784 | .IQ | |
1785 | \fBpop_mpls\fR | |
1786 | . | |
1787 | .IP 2. | |
1788 | \fBpush_mpls\fR | |
1789 | . | |
1790 | .IP 3. | |
1791 | \fBpush_vlan\fR | |
1792 | . | |
1793 | .IP 4. | |
1794 | \fBdec_ttl\fR | |
1795 | .IQ | |
1796 | \fBdec_mpls_ttl\fR | |
1797 | . | |
1798 | .IP 5. | |
1799 | \fBload\fR | |
1800 | .IQ | |
1b0ee636 TG |
1801 | \fBmove\fR |
1802 | .IQ | |
7fdb60a7 SH |
1803 | \fBmod_dl_dst\fR |
1804 | .IQ | |
1805 | \fBmod_dl_src\fR | |
1806 | .IQ | |
1807 | \fBmod_nw_dst\fR | |
1808 | .IQ | |
1809 | \fBmod_nw_src\fR | |
1810 | .IQ | |
1811 | \fBmod_nw_tos\fR | |
1812 | .IQ | |
ff14eb7a JR |
1813 | \fBmod_nw_ecn\fR |
1814 | .IQ | |
0c20dbe4 JR |
1815 | \fBmod_nw_ttl\fR |
1816 | .IQ | |
7fdb60a7 SH |
1817 | \fBmod_tp_dst\fR |
1818 | .IQ | |
1819 | \fBmod_tp_src\fR | |
1820 | .IQ | |
1821 | \fBmod_vlan_pcp\fR | |
1822 | .IQ | |
1823 | \fBmod_vlan_vid\fR | |
1824 | .IQ | |
1825 | \fBset_field\fR | |
1826 | .IQ | |
1827 | \fBset_tunnel\fR | |
1828 | .IQ | |
1829 | \fBset_tunnel64\fR | |
1830 | .IQ | |
1831 | The action set can contain any number of these actions, with | |
1b0ee636 TG |
1832 | cumulative effect. They will be applied in the order as added. |
1833 | That is, when multiple actions modify the same part of a field, | |
1834 | the later modification takes effect, and when they modify | |
1835 | different parts of a field (or different fields), then both | |
7fdb60a7 SH |
1836 | modifications are applied. |
1837 | . | |
1838 | .IP 6. | |
1839 | \fBset_queue\fR | |
1840 | . | |
1841 | .IP 7. | |
1842 | \fBgroup\fR | |
1843 | .IQ | |
1844 | \fBoutput\fR | |
1845 | .IQ | |
2e34a6a3 SS |
1846 | \fBresubmit\fR |
1847 | .IQ | |
1848 | If more than one of these actions is present, then the one listed | |
1849 | earliest above is executed and the others are ignored, regardless of | |
1850 | the order in which they were added to the action set. (If none of these | |
1851 | actions is present, the action set has no real effect, because the | |
1852 | modified packet is not sent anywhere and thus the modifications are | |
1853 | not visible.) | |
7fdb60a7 SH |
1854 | .RE |
1855 | .IP | |
1856 | Only the actions listed above may be written to the action set. | |
1857 | . | |
4cceacb9 JS |
1858 | .IP \fBwrite_metadata\fB:\fIvalue\fR[/\fImask\fR] |
1859 | Updates the metadata field for the flow. If \fImask\fR is omitted, the | |
1860 | metadata field is set exactly to \fIvalue\fR; if \fImask\fR is specified, then | |
1861 | a 1-bit in \fImask\fR indicates that the corresponding bit in the metadata | |
1862 | field will be replaced with the corresponding bit from \fIvalue\fR. Both | |
1863 | \fIvalue\fR and \fImask\fR are 64-bit values that are decimal by default; use | |
1864 | a \fB0x\fR prefix to specify them in hexadecimal. | |
1865 | . | |
3200ed58 JR |
1866 | .IP \fBmeter\fR:\fImeter_id\fR |
1867 | Apply the \fImeter_id\fR before any other actions. If a meter band rate is | |
1868 | exceeded, the packet may be dropped, or modified, depending on the meter | |
1869 | band type. See the description of the \fBMeter Table Commands\fR, above, | |
1870 | for more details. | |
1871 | . | |
8dd54666 IY |
1872 | .IP \fBgoto_table\fR:\fItable\fR |
1873 | Indicates the next table in the process pipeline. | |
8dd54666 | 1874 | . |
0e553d9c BP |
1875 | .IP "\fBfin_timeout(\fIargument\fR[\fB,\fIargument\fR]\fB)" |
1876 | This action changes the idle timeout or hard timeout, or both, of this | |
1877 | OpenFlow rule when the rule matches a TCP packet with the FIN or RST | |
1878 | flag. When such a packet is observed, the action reduces the rule's | |
1879 | timeouts to those specified on the action. If the rule's existing | |
1880 | timeout is already shorter than the one that the action specifies, | |
1881 | then that timeout is unaffected. | |
1882 | .IP | |
1883 | \fIargument\fR takes the following forms: | |
1884 | .RS | |
1885 | .IP "\fBidle_timeout=\fIseconds\fR" | |
1886 | Causes the flow to expire after the given number of seconds of | |
1887 | inactivity. | |
1888 | . | |
1889 | .IP "\fBhard_timeout=\fIseconds\fR" | |
1890 | Causes the flow to expire after the given number of seconds, | |
1891 | regardless of activity. (\fIseconds\fR specifies time since the | |
1892 | flow's creation, not since the receipt of the FIN or RST.) | |
1893 | .RE | |
1894 | .IP | |
1895 | This action was added in Open vSwitch 1.5.90. | |
29089a54 RL |
1896 | . |
1897 | .IP "\fBsample(\fIargument\fR[\fB,\fIargument\fR]...\fB)\fR" | |
1898 | Samples packets and sends one sample for every sampled packet. | |
1899 | .IP | |
1900 | \fIargument\fR takes the following forms: | |
1901 | .RS | |
1902 | .IP "\fBprobability=\fIpackets\fR" | |
1903 | The number of sampled packets out of 65535. Must be greater or equal to 1. | |
1904 | .IP "\fBcollector_set_id=\fIid\fR" | |
1905 | The unsigned 32-bit integer identifier of the set of sample collectors | |
1906 | to send sampled packets to. Defaults to 0. | |
1907 | .IP "\fBobs_domain_id=\fIid\fR" | |
1908 | When sending samples to IPFIX collectors, the unsigned 32-bit integer | |
1909 | Observation Domain ID sent in every IPFIX flow record. Defaults to 0. | |
1910 | .IP "\fBobs_point_id=\fIid\fR" | |
1911 | When sending samples to IPFIX collectors, the unsigned 32-bit integer | |
1912 | Observation Point ID sent in every IPFIX flow record. Defaults to 0. | |
1913 | .RE | |
1914 | .IP | |
1915 | Refer to \fBovs\-vswitchd.conf.db\fR(8) for more details on | |
1916 | configuring sample collector sets. | |
1917 | .IP | |
1918 | This action was added in Open vSwitch 1.10.90. | |
1919 | . | |
848e8809 | 1920 | .IP "\fBexit\fR" |
7fdb60a7 SH |
1921 | This action causes Open vSwitch to immediately halt execution of |
1922 | further actions. Those actions which have already been executed are | |
1923 | unaffected. Any further actions, including those which may be in | |
1924 | other tables, or different levels of the \fBresubmit\fR call stack, | |
1925 | are ignored. Actions in the action set is still executed (specify | |
1926 | \fBclear_actions\fR before \fBexit\fR to discard them). | |
18080541 BP |
1927 | . |
1928 | .IP "\fBconjunction(\fIid\fB, \fIk\fB/\fIn\fR\fB)\fR" | |
1929 | An individual OpenFlow flow can match only a single value for each | |
1930 | field. However, situations often arise where one wants to match one | |
1931 | of a set of values within a field or fields. For matching a single | |
1932 | field against a set, it is straightforward and efficient to add | |
1933 | multiple flows to the flow table, one for each value in the set. For | |
1934 | example, one might use the following flows to send packets with IP | |
1935 | source address \fIa\fR, \fIb\fR, \fIc\fR, or \fId\fR to the OpenFlow | |
1936 | controller: | |
1937 | .RS +1in | |
1938 | .br | |
1939 | \fBip,ip_src=\fIa\fB actions=controller\fR | |
1940 | .br | |
1941 | \fBip,ip_src=\fIb\fB actions=controller\fR | |
1942 | .br | |
1943 | \fBip,ip_src=\fIc\fB actions=controller\fR | |
1944 | .br | |
1945 | \fBip,ip_src=\fId\fB actions=controller\fR | |
1946 | .br | |
1947 | .RE | |
1948 | .IP | |
1949 | Similarly, these flows send packets with IP destination address | |
1950 | \fIe\fR, \fIf\fR, \fIg\fR, or \fIh\fR to the OpenFlow controller: | |
1951 | .RS +1in | |
1952 | .br | |
1953 | \fBip,ip_dst=\fIe\fB actions=controller\fR | |
1954 | .br | |
1955 | \fBip,ip_dst=\fIf\fB actions=controller\fR | |
1956 | .br | |
1957 | \fBip,ip_dst=\fIg\fB actions=controller\fR | |
1958 | .br | |
1959 | \fBip,ip_dst=\fIh\fB actions=controller\fR | |
1960 | .br | |
1961 | .RE | |
1962 | .IP | |
1963 | Installing all of the above flows in a single flow table yields a | |
1964 | disjunctive effect: a packet is sent to the controller if \fBip_src\fR | |
1965 | \[mo] {\fIa\fR,\fIb\fR,\fIc\fR,\fId\fR} or \fBip_dst\fR \[mo] | |
1966 | {\fIe\fR,\fIf\fR,\fIg\fR,\fIh\fR} (or both). (Pedantically, if both | |
1967 | of the above sets of flows are present in the flow table, they should | |
1968 | have different priorities, because OpenFlow says that the results are | |
1969 | undefined when two flows with same priority can both match a single | |
1970 | packet.) | |
1971 | .IP | |
1972 | Suppose, on the other hand, one wishes to match conjunctively, that | |
1973 | is, to send a packet to the controller only if both \fBip_src\fR \[mo] | |
1974 | {\fIa\fR,\fIb\fR,\fIc\fR,\fId\fR} and \fBip_dst\fR \[mo] | |
1975 | {\fIe\fR,\fIf\fR,\fIg\fR,\fIh\fR}. This requires 4 \[mu] 4 = 16 | |
1976 | flows, one for each possible pairing of \fBip_src\fR and \fBip_dst\fR. | |
1977 | That is acceptable for our small example, but it does not gracefully | |
1978 | extend to larger sets or greater numbers of dimensions. | |
1979 | .IP | |
1980 | The \fBconjunction\fR action is a solution for conjunctive matches | |
1981 | that is built into Open vSwitch. A \fBconjunction\fR action ties | |
1982 | groups of individual OpenFlow flows into higher-level ``conjunctive | |
1983 | flows''. Each group corresponds to one dimension, and each flow | |
1984 | within the group matches one possible value for the dimension. A | |
1985 | packet that matches one flow from each group matches the conjunctive | |
1986 | flow. | |
1987 | .IP | |
1988 | To implement a conjunctive flow with \fBconjunction\fR, assign the | |
1989 | conjunctive flow a 32-bit \fIid\fR, which must be unique within an | |
1990 | OpenFlow table. Assign each of the \fIn\fR \[>=] 2 dimensions a | |
1991 | unique number from 1 to \fIn\fR; the ordering is unimportant. Add one | |
1992 | flow to the OpenFlow flow table for each possible value of each | |
1993 | dimension with \fBconjunction(\fIid, \fIk\fB/\fIn\fB)\fR as the flow's | |
1994 | actions, where \fIk\fR is the number assigned to the flow's dimension. | |
1995 | Together, these flows specify the conjunctive flow's match condition. | |
1996 | When the conjunctive match condition is met, Open vSwitch looks up one | |
1997 | more flow that specifies the conjunctive flow's actions and receives | |
1998 | its statistics. This flow is found by setting \fBconj_id\fR to the | |
1999 | specified \fIid\fR and then again searching the flow table. | |
2000 | .IP | |
2001 | The following flows provide an example. Whenever the IP source is one | |
2002 | of the values in the flows that match on the IP source (dimension 1 of | |
2003 | 2), \fIand\fR the IP destination is one of the values in the flows | |
2004 | that match on IP destination (dimension 2 of 2), Open vSwitch searches | |
2005 | for a flow that matches \fBconj_id\fR against the conjunction ID | |
2006 | (1234), finding the first flow listed below. | |
2007 | .RS +1in | |
2008 | .br | |
2009 | .B "conj_id=1234 actions=controller" | |
2010 | .br | |
2011 | .B "ip,ip_src=10.0.0.1 actions=conjunction(1234, 1/2)" | |
2012 | .br | |
2013 | .B "ip,ip_src=10.0.0.4 actions=conjunction(1234, 1/2)" | |
2014 | .br | |
2015 | .B "ip,ip_src=10.0.0.6 actions=conjunction(1234, 1/2)" | |
2016 | .br | |
2017 | .B "ip,ip_src=10.0.0.7 actions=conjunction(1234, 1/2)" | |
2018 | .br | |
2019 | .B "ip,ip_dst=10.0.0.2 actions=conjunction(1234, 2/2)" | |
2020 | .br | |
2021 | .B "ip,ip_dst=10.0.0.5 actions=conjunction(1234, 2/2)" | |
2022 | .br | |
2023 | .B "ip,ip_dst=10.0.0.7 actions=conjunction(1234, 2/2)" | |
2024 | .br | |
2025 | .B "ip,ip_dst=10.0.0.8 actions=conjunction(1234, 2/2)" | |
2026 | .RE | |
2027 | .IP | |
2028 | Many subtleties exist: | |
2029 | .RS | |
2030 | .IP \(bu | |
2031 | In the example above, every flow in a single dimension has the same | |
2032 | form, that is, dimension 1 matches on \fBip_src\fR, dimension 2 on | |
2033 | \fBip_dst\fR, but this is not a requirement. Different flows within a | |
2034 | dimension may match on different bits within a field (e.g. IP network | |
2035 | prefixes of different lengths, or TCP/UDP port ranges as bitwise | |
2036 | matches), or even on entirely different fields (e.g. to match packets | |
2037 | for TCP source port 80 or TCP destination port 80). | |
2038 | .IP \(bu | |
2039 | The flows within a dimension can vary their matches across more than | |
2040 | one field, e.g. to match only specific pairs of IP source and | |
2041 | destination addresses or L4 port numbers. | |
2042 | .IP \(bu | |
2043 | A flow may have multiple \fBconjunction\fR actions, with different | |
2044 | \fIid\fR values. This is useful for multiple conjunctive flows with | |
2045 | overlapping sets. If one conjunctive flow matches packets with both | |
2046 | \fBip_src\fR \[mo] {\fIa\fR,\fIb\fR} and \fBip_dst\fR \[mo] | |
2047 | {\fId\fR,\fIe\fR} and a second conjunctive flow matches \fBip_src\fR | |
2048 | \[mo] {\fIb\fR,\fIc\fR} and \fBip_dst\fR \[mo] {\fIf\fR,\fIg\fR}, for | |
2049 | example, then the flow that matches \fBip_src=\fIb\fR would have two | |
2050 | \fBconjunction\fR actions, one for each conjunctive flow. The order | |
2051 | of \fBconjunction\fR actions within a list of actions is not | |
2052 | significant. | |
2053 | .IP \(bu | |
f08e39dd BP |
2054 | A flow with \fBconjunction\fR actions may also include \fBnote\fR |
2055 | actions for annotations, but not any other kind of actions. (They | |
2056 | would not be useful because they would never be executed.) | |
18080541 BP |
2057 | .IP \(bu |
2058 | All of the flows that constitute a conjunctive flow with a given | |
2059 | \fIid\fR must have the same priority. (Flows with the same \fIid\fR | |
2060 | but different priorities are currently treated as different | |
2061 | conjunctive flows, that is, currently \fIid\fR values need only be | |
2062 | unique within an OpenFlow table at a given priority. This behavior | |
2063 | isn't guaranteed to stay the same in later releases, so please use | |
2064 | \fIid\fR values unique within an OpenFlow table.) | |
2065 | .IP \(bu | |
2066 | Conjunctive flows must not overlap with each other, at a given | |
2067 | priority, that is, any given packet must be able to match at most one | |
2068 | conjunctive flow at a given priority. Overlapping conjunctive flows | |
2069 | yield unpredictable results. | |
2070 | .IP \(bu | |
2071 | Following a conjunctive flow match, the search for the flow with | |
2072 | \fBconj_id=\fIid\fR is done in the same general-purpose way as other flow | |
2073 | table searches, so one can use flows with \fBconj_id=\fIid\fR to act | |
2074 | differently depending on circumstances. (One exception is that the | |
2075 | search for the \fBconj_id=\fIid\fR flow itself ignores conjunctive flows, | |
2076 | to avoid recursion.) If the search with \fBconj_id=\fIid\fR fails, Open | |
2077 | vSwitch acts as if the conjunctive flow had not matched at all, and | |
2078 | continues searching the flow table for other matching flows. | |
2079 | .IP \(bu | |
2080 | OpenFlow prerequisite checking occurs for the flow with | |
2081 | \fBconj_id=\fIid\fR in the same way as any other flow, e.g. in an | |
2082 | OpenFlow 1.1+ context, putting a \fBmod_nw_src\fR action into the | |
2083 | example above would require adding an \fBip\fR match, like this: | |
2084 | .RS +1in | |
2085 | .br | |
2086 | .B "conj_id=1234,ip actions=mod_nw_src:1.2.3.4,controller" | |
2087 | .br | |
2088 | .RE | |
2089 | .IP \(bu | |
2090 | OpenFlow prerequisite checking also occurs for the individual flows | |
2091 | that comprise a conjunctive match in the same way as any other flow. | |
2092 | .IP \(bu | |
2093 | The flows that constitute a conjunctive flow do not have useful | |
2094 | statistics. They are never updated with byte or packet counts, and so | |
2095 | on. (For such a flow, therefore, the idle and hard timeouts work much | |
2096 | the same way.) | |
2097 | .IP \(bu | |
2098 | Conjunctive flows can be a useful building block for negation, that | |
2099 | is, inequality matches like \fBtcp_src\fR \[!=] 80. To implement an | |
2100 | inequality match, convert it to a pair of range matches, e.g. 0 \[<=] | |
2101 | \fBtcp_src\ < 80 and 80 < \fBtcp_src\fR \[<=] 65535, then convert each | |
2102 | of the range matches into a collection of bitwise matches as explained | |
2103 | above in the description of \fBtcp_src\fR. | |
2104 | .IP \(bu | |
2105 | Sometimes there is a choice of which flows include a particular match. | |
2106 | For example, suppose that we added an extra constraint to our example, | |
2107 | to match on \fBip_src\fR \[mo] {\fIa\fR,\fIb\fR,\fIc\fR,\fId\fR} and | |
2108 | \fBip_dst\fR \[mo] {\fIe\fR,\fIf\fR,\fIg\fR,\fIh\fR} and \fBtcp_dst\fR | |
2109 | = \fIi\fR. One way to implement this is to add the new constraint to | |
2110 | the \fBconj_id\fR flow, like this: | |
2111 | .RS +1in | |
2112 | .br | |
2113 | \fBconj_id=1234,tcp,tcp_dst=\fIi\fB actions=mod_nw_src:1.2.3.4,controller\fR | |
2114 | .br | |
2115 | .RE | |
2116 | .IP | |
2117 | \fIbut this is not recommended\fR because of the cost of the extra | |
2118 | flow table lookup. Instead, add the constraint to the individual | |
2119 | flows, either in one of the dimensions or (slightly better) all of | |
2120 | them. | |
2121 | .IP \(bu | |
2122 | A conjunctive match must have \fIn\fR \[>=] 2 dimensions (otherwise a | |
2123 | conjunctive match is not necessary). Open vSwitch enforces this. | |
2124 | .IP \(bu | |
2125 | Each dimension within a conjunctive match should ordinarily have more | |
2126 | than one flow. Open vSwitch does not enforce this. | |
2127 | .RE | |
2128 | .IP | |
2129 | The \fBconjunction\fR action and \fBconj_id\fR field were introduced | |
2130 | in Open vSwitch 2.4. | |
24362cd6 | 2131 | .RE |
848e8809 | 2132 | . |
064af421 | 2133 | .PP |
e729e793 JP |
2134 | An opaque identifier called a cookie can be used as a handle to identify |
2135 | a set of flows: | |
2136 | . | |
623e1caf JP |
2137 | .IP \fBcookie=\fIvalue\fR |
2138 | . | |
2139 | A cookie can be associated with a flow using the \fBadd\-flow\fR, | |
2140 | \fBadd\-flows\fR, and \fBmod\-flows\fR commands. \fIvalue\fR can be any | |
2141 | 64-bit number and need not be unique among flows. If this field is | |
2142 | omitted, a default cookie value of 0 is used. | |
2143 | . | |
2144 | .IP \fBcookie=\fIvalue\fR\fB/\fImask\fR | |
e729e793 | 2145 | . |
e729e793 | 2146 | When using NXM, the cookie can be used as a handle for querying, |
623e1caf JP |
2147 | modifying, and deleting flows. \fIvalue\fR and \fImask\fR may be |
2148 | supplied for the \fBdel\-flows\fR, \fBmod\-flows\fR, \fBdump\-flows\fR, and | |
2149 | \fBdump\-aggregate\fR commands to limit matching cookies. A 1-bit in | |
2150 | \fImask\fR indicates that the corresponding bit in \fIcookie\fR must | |
2151 | match exactly, and a 0-bit wildcards that bit. A mask of \-1 may be used | |
2152 | to exactly match a cookie. | |
2153 | .IP | |
2154 | The \fBmod\-flows\fR command can update the cookies of flows that | |
2155 | match a cookie by specifying the \fIcookie\fR field twice (once with a | |
2156 | mask for matching and once without to indicate the new value): | |
2157 | .RS | |
2158 | .IP "\fBovs\-ofctl mod\-flows br0 cookie=1,actions=normal\fR" | |
2159 | Change all flows' cookies to 1 and change their actions to \fBnormal\fR. | |
2160 | .IP "\fBovs\-ofctl mod\-flows br0 cookie=1/\-1,cookie=2,actions=normal\fR" | |
2161 | Update cookies with a value of 1 to 2 and change their actions to | |
2162 | \fBnormal\fR. | |
2163 | .RE | |
2164 | .IP | |
2165 | The ability to match on cookies was added in Open vSwitch 1.5.0. | |
8cce2125 JP |
2166 | . |
2167 | .PP | |
4b6b46ce BP |
2168 | The following additional field sets the priority for flows added by |
2169 | the \fBadd\-flow\fR and \fBadd\-flows\fR commands. For | |
2170 | \fBmod\-flows\fR and \fBdel\-flows\fR when \fB\-\-strict\fR is | |
2171 | specified, priority must match along with the rest of the flow | |
623e1caf | 2172 | specification. For \fBmod-flows\fR without \fB\-\-strict\fR, |
fdb3539e BP |
2173 | priority is only significant if the command creates a new flow, that |
2174 | is, non-strict \fBmod\-flows\fR does not match on priority and will | |
2175 | not change the priority of existing flows. Other commands do not | |
2176 | allow priority to be specified. | |
a9b4a41a | 2177 | . |
064af421 BP |
2178 | .IP \fBpriority=\fIvalue\fR |
2179 | The priority at which a wildcarded entry will match in comparison to | |
2180 | others. \fIvalue\fR is a number between 0 and 65535, inclusive. A higher | |
2181 | \fIvalue\fR will match before a lower one. An exact-match entry will always | |
2182 | have priority over an entry containing wildcards, so it has an implicit | |
2183 | priority value of 65535. When adding a flow, if the field is not specified, | |
2184 | the flow's priority will default to 32768. | |
4530afba BP |
2185 | .IP |
2186 | OpenFlow leaves behavior undefined when two or more flows with the | |
2187 | same priority can match a single packet. Some users expect | |
2188 | ``sensible'' behavior, such as more specific flows taking precedence | |
2189 | over less specific flows, but OpenFlow does not specify this and Open | |
2190 | vSwitch does not implement it. Users should therefore take care to | |
2191 | use priorities to ensure the behavior that they expect. | |
a9b4a41a | 2192 | . |
064af421 | 2193 | .PP |
fdb3539e BP |
2194 | The \fBadd\-flow\fR, \fBadd\-flows\fR, and \fBmod\-flows\fR commands |
2195 | support the following additional options. These options affect only | |
2196 | new flows. Thus, for \fBadd\-flow\fR and \fBadd\-flows\fR, these | |
2197 | options are always significant, but for \fBmod\-flows\fR they are | |
2198 | significant only if the command creates a new flow, that is, their | |
a993007b | 2199 | values do not update or affect existing flows. |
a9b4a41a | 2200 | . |
fdb3539e | 2201 | .IP "\fBidle_timeout=\fIseconds\fR" |
064af421 | 2202 | Causes the flow to expire after the given number of seconds of |
fdb3539e BP |
2203 | inactivity. A value of 0 (the default) prevents a flow from expiring |
2204 | due to inactivity. | |
a9b4a41a | 2205 | . |
064af421 BP |
2206 | .IP \fBhard_timeout=\fIseconds\fR |
2207 | Causes the flow to expire after the given number of seconds, | |
2208 | regardless of activity. A value of 0 (the default) gives the flow no | |
2209 | hard expiration deadline. | |
a9b4a41a | 2210 | . |
ca26eb44 RB |
2211 | .IP "\fBimportance=\fIvalue\fR" |
2212 | Sets the importance of a flow. The flow entry eviction mechanism can | |
2213 | use importance as a factor in deciding which flow to evict. A value | |
2214 | of 0 (the default) makes the flow non-evictable on the basis of | |
2215 | importance. Specify a value between 0 and 65535. | |
2216 | .IP | |
2217 | Only OpenFlow 1.4 and later support \fBimportance\fR. | |
2218 | . | |
a993007b BP |
2219 | .IP "\fBsend_flow_rem\fR" |
2220 | Marks the flow with a flag that causes the switch to generate a ``flow | |
2221 | removed'' message and send it to interested controllers when the flow | |
2222 | later expires or is removed. | |
2223 | . | |
2224 | .IP "\fBcheck_overlap\fR" | |
2225 | Forces the switch to check that the flow match does not overlap that | |
2226 | of any different flow with the same priority in the same table. (This | |
2227 | check is expensive so it is best to avoid it.) | |
2228 | . | |
064af421 | 2229 | .PP |
4e312e69 BP |
2230 | The \fBdump\-flows\fR, \fBdump\-aggregate\fR, \fBdel\-flow\fR |
2231 | and \fBdel\-flows\fR commands support one additional optional field: | |
a9b4a41a | 2232 | . |
064af421 BP |
2233 | .TP |
2234 | \fBout_port=\fIport\fR | |
c6100d92 | 2235 | If set, a matching flow must include an output action to \fIport\fR, |
60a0b9e5 | 2236 | which must be an OpenFlow port number or name (e.g. \fBlocal\fR). |
a9b4a41a | 2237 | . |
064af421 | 2238 | .SS "Table Entry Output" |
a9b4a41a | 2239 | . |
4e312e69 | 2240 | The \fBdump\-tables\fR and \fBdump\-aggregate\fR commands print information |
064af421 | 2241 | about the entries in a datapath's tables. Each line of output is a |
f27f2134 BP |
2242 | flow entry as described in \fBFlow Syntax\fR, above, plus some |
2243 | additional fields: | |
a9b4a41a | 2244 | . |
f27f2134 BP |
2245 | .IP \fBduration=\fIsecs\fR |
2246 | The time, in seconds, that the entry has been in the table. | |
2247 | \fIsecs\fR includes as much precision as the switch provides, possibly | |
2248 | to nanosecond resolution. | |
a9b4a41a | 2249 | . |
064af421 BP |
2250 | .IP \fBn_packets\fR |
2251 | The number of packets that have matched the entry. | |
a9b4a41a | 2252 | . |
064af421 BP |
2253 | .IP \fBn_bytes\fR |
2254 | The total number of bytes from packets that have matched the entry. | |
a9b4a41a | 2255 | . |
064af421 | 2256 | .PP |
f27f2134 BP |
2257 | The following additional fields are included only if the switch is |
2258 | Open vSwitch 1.6 or later and the NXM flow format is used to dump the | |
2259 | flow (see the description of the \fB\-\-flow-format\fR option below). | |
2260 | The values of these additional fields are approximations only and in | |
2261 | particular \fBidle_age\fR will sometimes become nonzero even for busy | |
2262 | flows. | |
2263 | . | |
2264 | .IP \fBhard_age=\fIsecs\fR | |
2265 | The integer number of seconds since the flow was added or modified. | |
2266 | \fBhard_age\fR is displayed only if it differs from the integer part | |
2267 | of \fBduration\fR. (This is separate from \fBduration\fR because | |
2268 | \fBmod\-flows\fR restarts the \fBhard_timeout\fR timer without zeroing | |
2269 | \fBduration\fR.) | |
2270 | . | |
2271 | .IP \fBidle_age=\fIsecs\fR | |
2272 | The integer number of seconds that have passed without any packets | |
2273 | passing through the flow. | |
a9b4a41a | 2274 | . |
7395c052 NZ |
2275 | .SS "Group Syntax" |
2276 | .PP | |
2277 | Some \fBovs\-ofctl\fR commands accept an argument that describes a group or | |
2278 | groups. Such flow descriptions comprise a series | |
2279 | \fIfield\fB=\fIvalue\fR assignments, separated by commas or white | |
2280 | space. (Embedding spaces into a group description normally requires | |
2281 | quoting to prevent the shell from breaking the description into | |
2282 | multiple arguments.). Unless noted otherwise only the last instance | |
2283 | of each field is honoured. | |
2284 | .PP | |
2285 | .IP \fBgroup_id=\fIid\fR | |
2286 | The integer group id of group. | |
19187a71 | 2287 | When this field is specified in \fBdel\-groups\fR or \fBdump\-groups\fR, |
7395c052 NZ |
2288 | the keyword "all" may be used to designate all groups. |
2289 | . | |
2290 | This field is required. | |
2291 | ||
2292 | ||
2293 | .IP \fBtype=\fItype\fR | |
bdbb8426 | 2294 | The type of the group. The \fBadd-group\fR, \fBadd-groups\fR and |
ed1d5ef3 | 2295 | \fBmod-groups\fR commands require this field. It is prohibited for |
bdbb8426 | 2296 | other commands. The following keywords designated the allowed types: |
7395c052 NZ |
2297 | .RS |
2298 | .IP \fBall\fR | |
2299 | Execute all buckets in the group. | |
2300 | .IP \fBselect\fR | |
2301 | Execute one bucket in the group. | |
2302 | The switch should select the bucket in such a way that should implement | |
2303 | equal load sharing is achieved. The switch may optionally select the | |
2304 | bucket based on bucket weights. | |
2305 | .IP \fBindirect\fR | |
2306 | Executes the one bucket in the group. | |
2307 | .IP \fBff\fR | |
2308 | .IQ \fBfast_failover\fR | |
2309 | Executes the first live bucket in the group which is associated with | |
2310 | a live port or group. | |
2311 | .RE | |
2312 | ||
bdbb8426 SH |
2313 | .IP \fBcommand_bucket_id=\fIid\fR |
2314 | The bucket to operate on. The \fBinsert-buckets\fR and \fBremove-buckets\fR | |
2315 | commands require this field. It is prohibited for other commands. | |
2316 | \fIid\fR may be an integer or one of the following keywords: | |
2317 | .RS | |
2318 | .IP \fBall\fR | |
2319 | Operate on all buckets in the group. | |
2320 | Only valid when used with the \fBremove-buckets\fR command in which | |
2321 | case the effect is to remove all buckets from the group. | |
2322 | .IP \fBfirst\fR | |
2323 | Operate on the first bucket present in the group. | |
2324 | In the case of the \fBinsert-buckets\fR command the effect is to | |
2325 | insert new bucets just before the first bucket already present in the group; | |
2326 | or to replace the buckets of the group if there are no buckets already present | |
2327 | in the group. | |
2328 | In the case of the \fBremove-buckets\fR command the effect is to | |
2329 | remove the first bucket of the group; or do nothing if there are no | |
2330 | buckets present in the group. | |
2331 | .IP \fBlast\fR | |
2332 | Operate on the last bucket present in the group. | |
2333 | In the case of the \fBinsert-buckets\fR command the effect is to | |
2334 | insert new bucets just after the last bucket already present in the group; | |
2335 | or to replace the buckets of the group if there are no buckets already present | |
2336 | in the group. | |
2337 | In the case of the \fBremove-buckets\fR command the effect is to | |
2338 | remove the last bucket of the group; or do nothing if there are no | |
2339 | buckets present in the group. | |
2340 | .RE | |
2341 | .IP | |
2342 | If \fIid\fR is an integer then it should correspond to the \fBbucket_id\fR | |
2343 | of a bucket present in the group. | |
2344 | In case of the \fBinsert-buckets\fR command the effect is to | |
2345 | insert buckets just before the bucket in the group whose \fBbucket_id\fR is | |
2346 | \fIid\fR. | |
2347 | In case of the \fBiremove-buckets\fR command the effect is to | |
2348 | remove the in the group whose \fBbucket_id\fR is \fIid\fR. | |
2349 | It is an error if there is no bucket persent group in whose \fBbucket_id\fR is | |
2350 | \fIid\fR. | |
2351 | ||
b879391e SH |
2352 | .IP \fBselection_method\fR=\fImethod\fR |
2353 | The selection method used to select a bucket for a select group. | |
2354 | This is a string of 1 to 15 bytes in length known to lower layers. | |
2355 | This field is optional for \fBadd\-group\fR, \fBadd\-groups\fR and | |
2356 | \fBmod\-group\fR commands on groups of type \fBselect\fR. Prohibited | |
2357 | otherwise. The default value is the empty string. | |
2358 | .IP | |
2359 | This option will use a Netronome OpenFlow extension which is only supported | |
2360 | when using Open vSwitch 2.4 and later with OpenFlow 1.5 and later. | |
2361 | ||
2362 | .IP \fBselection_method_param\fR=\fIparam\fR | |
2363 | 64-bit integer parameter to the selection method selected by the | |
2364 | \fBselection_method\fR field. The parameter's use is defined by the | |
2365 | lower-layer that implements the \fBselection_method\fR. It is optional if | |
2366 | the \fBselection_method\fR field is specified as a non-empty string. | |
2367 | Prohibited otherwise. The default value is zero. | |
2368 | .IP | |
2369 | This option will use a Netronome OpenFlow extension which is only supported | |
2370 | when using Open vSwitch 2.4 and later with OpenFlow 1.5 and later. | |
2371 | ||
2372 | .IP \fBfields\fR=\fIparam\fR | |
2373 | The field parameters to selection method selected by the | |
2374 | \fBselection_method\fR field. The syntax is described in \fBFlow Syntax\fR | |
2375 | with the additional restrictions that if a value is provided it is | |
2376 | treated as a wildcard mask and wildcard masks following a slash are | |
2377 | prohibited. The pre-requisites of fields must be provided by any flows that | |
2378 | output to the group. The use of the fields is defined by the lower-layer | |
2379 | that implements the \fBselection_method\fR. They are optional if the | |
2380 | \fBselection_method\fR field is specified as a non-empty string. | |
2381 | Prohibited otherwise. The default is no fields. | |
2382 | .IP | |
2383 | This option will use a Netronome OpenFlow extension which is only supported | |
2384 | when using Open vSwitch 2.4 and later with OpenFlow 1.5 and later. | |
2385 | ||
7395c052 NZ |
2386 | .IP \fBbucket\fR=\fIbucket_parameters\fR |
2387 | The \fBadd-group\fR, \fBadd-groups\fR and \fBmod-group\fR commands | |
2388 | require at least one bucket field. Bucket fields must appear after | |
2389 | all other fields. | |
2390 | . | |
2391 | Multiple bucket fields to specify multiple buckets. | |
2392 | The order in which buckets are specified corresponds to their order in | |
2393 | the group. If the type of the group is "indirect" then only one group may | |
2394 | be specified. | |
2395 | . | |
2396 | \fIbucket_parameters\fR consists of a list of \fIfield\fB=\fIvalue\fR | |
2397 | assignments, separated by commas or white space followed by a | |
2398 | comma-separated list of actions. | |
7395c052 NZ |
2399 | The fields for \fIbucket_parameters\fR are: |
2400 | . | |
2401 | .RS | |
2d5d050c SH |
2402 | .IP \fBbucket_id=\fIid\fR |
2403 | The 32-bit integer group id of the bucket. Values greater than | |
2404 | 0xffffff00 are reserved. | |
2405 | . | |
2406 | This field was added in Open vSwitch 2.4 to conform with the OpenFlow | |
d3cb080e | 2407 | 1.5 specification. It is not supported when earlier versions |
2d5d050c SH |
2408 | of OpenFlow are used. Open vSwitch will automatically allocate bucket |
2409 | ids when they are not specified. | |
f1457c26 TG |
2410 | .IP \fBactions=\fR[\fIaction\fR][\fB,\fIaction\fR...]\fR |
2411 | The syntax of actions are identical to the \fBactions=\fR field described in | |
2412 | \fBFlow Syntax\fR above. Specyfing \fBactions=\fR is optional, any unknown | |
2413 | bucket parameter will be interpreted as an action. | |
7395c052 NZ |
2414 | .IP \fBweight=\fIvalue\fR |
2415 | The relative weight of the bucket as an integer. This may be used by the switch | |
2416 | during bucket select for groups whose \fBtype\fR is \fBselect\fR. | |
2417 | .IP \fBwatch_port=\fIport\fR | |
2418 | Port used to determine liveness of group. | |
2419 | This or the \fBwatch_group\fR field is required | |
2420 | for groups whose \fBtype\fR is \fBff\fR or \fBfast_failover\fR. | |
2421 | .IP \fBwatch_group=\fIgroup_id\fR | |
2422 | Group identifier of group used to determine liveness of group. | |
2423 | This or the \fBwatch_port\fR field is required | |
2424 | for groups whose \fBtype\fR is \fBff\fR or \fBfast_failover\fR. | |
2425 | .RE | |
2426 | . | |
3200ed58 JR |
2427 | .SS "Meter Syntax" |
2428 | .PP | |
2429 | The meter table commands accept an argument that describes a meter. | |
2430 | Such meter descriptions comprise a series \fIfield\fB=\fIvalue\fR | |
2431 | assignments, separated by commas or white space. | |
2432 | (Embedding spaces into a group description normally requires | |
2433 | quoting to prevent the shell from breaking the description into | |
2434 | multiple arguments.). Unless noted otherwise only the last instance | |
2435 | of each field is honoured. | |
2436 | .PP | |
2437 | .IP \fBmeter=\fIid\fR | |
2438 | The integer meter id of the meter. | |
2439 | When this field is specified in \fBdel-meter\fR, \fBdump-meter\fR, or | |
2440 | \fBmeter-stats\fR, the keyword "all" may be used to designate all meters. | |
2441 | . | |
2442 | This field is required, exept for \fBmeter-stats\fR, which dumps all stats | |
2443 | when this field is not specified. | |
2444 | ||
2445 | .IP \fBkbps\fR | |
2446 | .IQ \fBpktps\fR | |
2447 | The unit for the meter band rate parameters, either kilobits per second, or | |
2448 | packets per second, respectively. One of these must be specified. The burst | |
2449 | size unit corresponds to the rate unit by dropping the "per second", i.e., | |
2450 | burst is in units of kilobits or packets, respectively. | |
2451 | ||
2452 | .IP \fBburst\fR | |
2453 | Specify burst size for all bands, or none of them, if this flag is not given. | |
2454 | ||
2455 | .IP \fBstats\fR | |
2456 | Collect meter and band statistics. | |
2457 | ||
2458 | .IP \fBbands\fR=\fIband_parameters\fR | |
2459 | The \fBadd-meter\fR and \fBmod-meter\fR commands require at least one | |
2460 | band specification. Bands must appear after all other fields. | |
2461 | .RS | |
2462 | .IP \fBtype=\fItype\fR | |
2463 | The type of the meter band. This keyword starts a new band specification. | |
2464 | Each band specifies a rate above which the band is to take some action. The | |
2465 | action depends on the band type. If multiple bands' rate is exceeded, then | |
2466 | the band with the highest rate among the exceeded bands is selected. | |
2467 | The following keywords designate the allowed | |
2468 | meter band types: | |
2469 | .RS | |
2470 | .IP \fBdrop\fR | |
2471 | Drop packets exceeding the band's rate limit. | |
2472 | .RE | |
2473 | . | |
2474 | .IP "The other \fIband_parameters\fR are:" | |
2475 | .IP \fBrate=\fIvalue\fR | |
2476 | The relative rate limit for this band, in kilobits per second or packets per | |
2477 | second, depending on the meter flags defined above. | |
96660ed1 BP |
2478 | .IP \fBburst_size=\fIsize\fR |
2479 | The maximum burst allowed for the band. If \fBpktps\fR is specified, | |
2480 | then \fIsize\fR is a packet count, otherwise it is in kilobits. If | |
2481 | unspecified, the switch is free to select some reasonable value | |
2482 | depending on its configuration. | |
3200ed58 JR |
2483 | .RE |
2484 | . | |
064af421 BP |
2485 | .SH OPTIONS |
2486 | .TP | |
4e312e69 | 2487 | \fB\-\-strict\fR |
064af421 | 2488 | Uses strict matching when running flow modification commands. |
a9b4a41a | 2489 | . |
db5076ee | 2490 | .IP "\fB\-\-bundle\fR" |
39c94593 | 2491 | Execute flow mods as an OpenFlow 1.4 atomic bundle transaction. |
db5076ee JR |
2492 | .RS |
2493 | .IP \(bu | |
2494 | Within a bundle, all flow mods are processed in the order they appear | |
39c94593 JR |
2495 | and as a single atomic transaction, meaning that if one of them fails, |
2496 | the whole transaction fails and none of the changes are made to the | |
2497 | \fIswitch\fR's flow table, and that each given datapath packet | |
2498 | traversing the OpenFlow tables sees the flow tables either as before | |
2499 | the transaction, or after all the flow mods in the bundle have been | |
2500 | successfully applied. | |
db5076ee JR |
2501 | .IP \(bu |
2502 | The beginning and the end of the flow table modification commands in a | |
2503 | bundle are delimited with OpenFlow 1.4 bundle control messages, which | |
2504 | makes it possible to stream the included commands without explicit | |
2505 | OpenFlow barriers, which are otherwise used after each flow table | |
2506 | modification command. This may make large modifications execute | |
2507 | faster as a bundle. | |
2508 | .IP \(bu | |
2509 | Bundles require OpenFlow 1.4 or higher. An explicit \fB-O | |
2510 | OpenFlow14\fR option is not needed, but you may need to enable | |
2511 | OpenFlow 1.4 support for OVS by setting the OVSDB \fIprotocols\fR | |
2512 | column in the \fIbridge\fR table. | |
db5076ee JR |
2513 | .RE |
2514 | . | |
a53a8efa SH |
2515 | .so lib/ofp-version.man |
2516 | . | |
27527aa0 BP |
2517 | .IP "\fB\-F \fIformat\fR[\fB,\fIformat\fR...]" |
2518 | .IQ "\fB\-\-flow\-format=\fIformat\fR[\fB,\fIformat\fR...]" | |
2519 | \fBovs\-ofctl\fR supports the following individual flow formats, any | |
2520 | number of which may be listed as \fIformat\fR: | |
88ca35ee | 2521 | .RS |
27527aa0 BP |
2522 | .IP "\fBOpenFlow10\-table_id\fR" |
2523 | This is the standard OpenFlow 1.0 flow format. All OpenFlow switches | |
2524 | and all versions of Open vSwitch support this flow format. | |
88ca35ee | 2525 | . |
27527aa0 BP |
2526 | .IP "\fBOpenFlow10+table_id\fR" |
2527 | This is the standard OpenFlow 1.0 flow format plus a Nicira extension | |
2528 | that allows \fBovs\-ofctl\fR to specify the flow table in which a | |
2529 | particular flow should be placed. Open vSwitch 1.2 and later supports | |
2530 | this flow format. | |
2531 | . | |
2532 | .IP "\fBNXM\-table_id\fR (Nicira Extended Match)" | |
88ca35ee BP |
2533 | This Nicira extension to OpenFlow is flexible and extensible. It |
2534 | supports all of the Nicira flow extensions, such as \fBtun_id\fR and | |
27527aa0 BP |
2535 | registers. Open vSwitch 1.1 and later supports this flow format. |
2536 | . | |
2537 | .IP "\fBNXM+table_id\fR (Nicira Extended Match)" | |
2538 | This combines Nicira Extended match with the ability to place a flow | |
2539 | in a specific table. Open vSwitch 1.2 and later supports this flow | |
2540 | format. | |
e71bff1b BP |
2541 | . |
2542 | .IP "\fBOXM-OpenFlow12\fR" | |
2543 | .IQ "\fBOXM-OpenFlow13\fR" | |
aa233d57 | 2544 | .IQ "\fBOXM-OpenFlow14\fR" |
e71bff1b | 2545 | These are the standard OXM (OpenFlow Extensible Match) flow format in |
aa233d57 | 2546 | OpenFlow 1.2, 1.3, and 1.4, respectively. |
88ca35ee | 2547 | .RE |
27527aa0 | 2548 | . |
88ca35ee | 2549 | .IP |
27527aa0 BP |
2550 | \fBovs\-ofctl\fR also supports the following abbreviations for |
2551 | collections of flow formats: | |
2552 | .RS | |
2553 | .IP "\fBany\fR" | |
aa233d57 | 2554 | Any supported flow format. |
27527aa0 BP |
2555 | .IP "\fBOpenFlow10\fR" |
2556 | \fBOpenFlow10\-table_id\fR or \fBOpenFlow10+table_id\fR. | |
2557 | .IP "\fBNXM\fR" | |
2558 | \fBNXM\-table_id\fR or \fBNXM+table_id\fR. | |
e71bff1b | 2559 | .IP "\fBOXM\fR" |
aa233d57 | 2560 | \fBOXM-OpenFlow12\fR, \fBOXM-OpenFlow13\fR, or \fBOXM-OpenFlow14\fR. |
27527aa0 | 2561 | .RE |
4f564f8d | 2562 | . |
27527aa0 BP |
2563 | .IP |
2564 | For commands that modify the flow table, \fBovs\-ofctl\fR by default | |
2565 | negotiates the most widely supported flow format that supports the | |
2566 | flows being added. For commands that query the flow table, | |
2567 | \fBovs\-ofctl\fR by default uses the most advanced format supported by | |
2568 | the switch. | |
2569 | .IP | |
2570 | This option, where \fIformat\fR is a comma-separated list of one or | |
2571 | more of the formats listed above, limits \fBovs\-ofctl\fR's choice of | |
2572 | flow format. If a command cannot work as requested using one of the | |
2573 | specified flow formats, \fBovs\-ofctl\fR will report a fatal error. | |
54834960 EJ |
2574 | . |
2575 | .IP "\fB\-P \fIformat\fR" | |
2576 | .IQ "\fB\-\-packet\-in\-format=\fIformat\fR" | |
2577 | \fBovs\-ofctl\fR supports the following packet_in formats, in order of | |
2578 | increasing capability: | |
2579 | .RS | |
2580 | .IP "\fBopenflow10\fR" | |
2581 | This is the standard OpenFlow 1.0 packet in format. It should be supported by | |
2582 | all OpenFlow switches. | |
2583 | . | |
2584 | .IP "\fBnxm\fR (Nicira Extended Match)" | |
2585 | This packet_in format includes flow metadata encoded using the NXM format. | |
2586 | . | |
2587 | .RE | |
2588 | .IP | |
2589 | Usually, \fBovs\-ofctl\fR prefers the \fBnxm\fR packet_in format, but will | |
2590 | allow the switch to choose its default if \fBnxm\fR is unsupported. When | |
2591 | \fIformat\fR is one of the formats listed in the above table, \fBovs\-ofctl\fR | |
2592 | will insist on the selected format. If the switch does not support the | |
2593 | requested format, \fBovs\-ofctl\fR will report a fatal error. This option only | |
ca8526e0 | 2594 | affects the \fBmonitor\fR command. |
54834960 | 2595 | . |
0c9560b7 BP |
2596 | .IP "\fB\-\-timestamp\fR" |
2597 | Print a timestamp before each received packet. This option only | |
f3dd1419 BP |
2598 | affects the \fBmonitor\fR, \fBsnoop\fR, and \fBofp\-parse\-pcap\fR |
2599 | commands. | |
0c9560b7 | 2600 | . |
4f564f8d BP |
2601 | .IP "\fB\-m\fR" |
2602 | .IQ "\fB\-\-more\fR" | |
2603 | Increases the verbosity of OpenFlow messages printed and logged by | |
2604 | \fBovs\-ofctl\fR commands. Specify this option more than once to | |
2605 | increase verbosity further. | |
1eb85ef5 | 2606 | . |
bdcc5925 BP |
2607 | .IP \fB\-\-sort\fR[\fB=\fIfield\fR] |
2608 | .IQ \fB\-\-rsort\fR[\fB=\fIfield\fR] | |
2609 | Display output sorted by flow \fIfield\fR in ascending | |
2610 | (\fB\-\-sort\fR) or descending (\fB\-\-rsort\fR) order, where | |
2611 | \fIfield\fR is any of the fields that are allowed for matching or | |
2612 | \fBpriority\fR to sort by priority. When \fIfield\fR is omitted, the | |
2613 | output is sorted by priority. Specify these options multiple times to | |
2614 | sort by multiple fields. | |
2615 | .IP | |
2616 | Any given flow will not necessarily specify a value for a given | |
2617 | field. This requires special treatement: | |
2618 | .RS | |
2619 | .IP \(bu | |
2620 | A flow that does not specify any part of a field that is used for sorting is | |
2621 | sorted after all the flows that do specify the field. For example, | |
2622 | \fB\-\-sort=tcp_src\fR will sort all the flows that specify a TCP | |
2623 | source port in ascending order, followed by the flows that do not | |
0d56eaf2 | 2624 | specify a TCP source port at all. |
bdcc5925 BP |
2625 | .IP \(bu |
2626 | A flow that only specifies some bits in a field is sorted as if the | |
2627 | wildcarded bits were zero. For example, \fB\-\-sort=nw_src\fR would | |
2628 | sort a flow that specifies \fBnw_src=192.168.0.0/24\fR the same as | |
2629 | \fBnw_src=192.168.0.0\fR. | |
2630 | .RE | |
2631 | .IP | |
2632 | These options currently affect only \fBdump\-flows\fR output. | |
2633 | . | |
1eb85ef5 EJ |
2634 | .ds DD \ |
2635 | \fBovs\-ofctl\fR detaches only when executing the \fBmonitor\fR or \ | |
2636 | \fBsnoop\fR commands. | |
2637 | .so lib/daemon.man | |
19945013 | 2638 | .so lib/unixctl.man |
ac300505 | 2639 | .SS "Public Key Infrastructure Options" |
84ee7bcf | 2640 | .so lib/ssl.man |
064af421 BP |
2641 | .so lib/vlog.man |
2642 | .so lib/common.man | |
a9b4a41a | 2643 | . |
1eb85ef5 | 2644 | .SH "RUNTIME MANAGEMENT COMMANDS" |
96761f58 BP |
2645 | \fBovs\-appctl\fR(8) can send commands to a running \fBovs\-ofctl\fR |
2646 | process. The supported commands are listed below. | |
2647 | . | |
1eb85ef5 | 2648 | .IP "\fBexit\fR" |
96761f58 BP |
2649 | Causes \fBovs\-ofctl\fR to gracefully terminate. This command applies |
2650 | only when executing the \fBmonitor\fR or \fBsnoop\fR commands. | |
2651 | . | |
1e1d00a5 BP |
2652 | .IP "\fBofctl/set\-output\-file \fIfile\fR" |
2653 | Causes all subsequent output to go to \fIfile\fR instead of stderr. | |
2654 | This command applies only when executing the \fBmonitor\fR or | |
2655 | \fBsnoop\fR commands. | |
2656 | . | |
96761f58 BP |
2657 | .IP "\fBofctl/send \fIofmsg\fR..." |
2658 | Sends each \fIofmsg\fR, specified as a sequence of hex digits that | |
2659 | express an OpenFlow message, on the OpenFlow connection. This command | |
2660 | is useful only when executing the \fBmonitor\fR command. | |
2661 | . | |
bb638b9a BP |
2662 | .IP "\fBofctl/barrier\fR" |
2663 | Sends an OpenFlow barrier request on the OpenFlow connection and waits | |
2664 | for a reply. This command is useful only for the \fBmonitor\fR | |
2665 | command. | |
2666 | . | |
064af421 | 2667 | .SH EXAMPLES |
a9b4a41a | 2668 | . |
045b2e5c BP |
2669 | The following examples assume that \fBovs\-vswitchd\fR has a bridge |
2670 | named \fBbr0\fR configured. | |
a9b4a41a | 2671 | . |
064af421 | 2672 | .TP |
045b2e5c | 2673 | \fBovs\-ofctl dump\-tables br0\fR |
064af421 BP |
2674 | Prints out the switch's table stats. (This is more interesting after |
2675 | some traffic has passed through.) | |
a9b4a41a | 2676 | . |
064af421 | 2677 | .TP |
045b2e5c | 2678 | \fBovs\-ofctl dump\-flows br0\fR |
064af421 | 2679 | Prints the flow entries in the switch. |
a9b4a41a | 2680 | . |
064af421 | 2681 | .SH "SEE ALSO" |
a9b4a41a | 2682 | . |
064af421 | 2683 | .BR ovs\-appctl (8), |
064af421 | 2684 | .BR ovs\-vswitchd (8) |
29089a54 | 2685 | .BR ovs\-vswitchd.conf.db (8) |