]>
Commit | Line | Data |
---|---|---|
a9b4a41a BP |
1 | .\" -*- nroff -*- |
2 | .de IQ | |
3 | . br | |
4 | . ns | |
5 | . IP "\\$1" | |
6 | .. | |
71e17a7a | 7 | .TH ovs\-ofctl 8 "January 2011" "Open vSwitch" "Open vSwitch Manual" |
064af421 | 8 | .ds PN ovs\-ofctl |
a9b4a41a | 9 | . |
064af421 BP |
10 | .SH NAME |
11 | ovs\-ofctl \- administer OpenFlow switches | |
a9b4a41a | 12 | . |
064af421 BP |
13 | .SH SYNOPSIS |
14 | .B ovs\-ofctl | |
15 | [\fIoptions\fR] \fIcommand \fR[\fIswitch\fR] [\fIargs\fR\&...] | |
a9b4a41a | 16 | . |
064af421 BP |
17 | .SH DESCRIPTION |
18 | The | |
19 | .B ovs\-ofctl | |
20 | program is a command line tool for monitoring and administering | |
21 | OpenFlow switches. It can also show the current state of an OpenFlow | |
22 | switch, including features, configuration, and table entries. | |
a9b4a41a | 23 | . |
064af421 | 24 | .SS "OpenFlow Switch Management Commands" |
a9b4a41a | 25 | .PP |
064af421 BP |
26 | These commands allow \fBovs\-ofctl\fR to monitor and administer an OpenFlow |
27 | switch. It is able to show the current state of a switch, including | |
28 | features, configuration, and table entries. | |
a9b4a41a | 29 | .PP |
064af421 BP |
30 | Most of these commands take an argument that specifies the method for |
31 | connecting to an OpenFlow switch. The following connection methods | |
32 | are supported: | |
a9b4a41a | 33 | . |
064af421 | 34 | .RS |
84ee7bcf BP |
35 | .so lib/vconn-active.man |
36 | . | |
064af421 BP |
37 | .IP "\fIfile\fR" |
38 | This is short for \fBunix:\fIfile\fR, as long as \fIfile\fR does not | |
39 | contain a colon. | |
84ee7bcf | 40 | . |
1a6f1e2a JG |
41 | .IP \fIbridge\fR |
42 | This is short for \fBunix:@RUNDIR@/\fIbridge\fB.mgmt\fR, as long as | |
43 | \fIbridge\fR does not contain a colon. | |
44 | . | |
45 | .IP [\fItype\fB@\fR]\fIdp\fR | |
46 | Attempts to look up the bridge associated with \fIdp\fR and open as | |
47 | above. If \fItype\fR is given, it specifies the datapath provider of | |
48 | \fIdp\fR, otherwise the default provider \fBsystem\fR is assumed. | |
064af421 | 49 | .RE |
a9b4a41a | 50 | . |
064af421 BP |
51 | .TP |
52 | \fBshow \fIswitch\fR | |
53 | Prints to the console information on \fIswitch\fR, including | |
54 | information on its flow tables and ports. | |
a9b4a41a | 55 | . |
064af421 BP |
56 | .TP |
57 | \fBstatus \fIswitch\fR [\fIkey\fR] | |
58 | Prints to the console a series of key-value pairs that report the | |
59 | status of \fIswitch\fR. If \fIkey\fR is specified, only the key-value | |
60 | pairs whose key names begin with \fIkey\fR are printed. If \fIkey\fR is | |
61 | omitted, all key-value pairs are printed. | |
a9b4a41a | 62 | . |
064af421 | 63 | .TP |
4e312e69 | 64 | \fBdump\-tables \fIswitch\fR |
064af421 BP |
65 | Prints to the console statistics for each of the flow tables used by |
66 | \fIswitch\fR. | |
a9b4a41a | 67 | . |
064af421 | 68 | .TP |
4e312e69 | 69 | \fBdump\-ports \fIswitch\fR [\fInetdev\fR] |
abaad8cf JP |
70 | Prints to the console statistics for network devices associated with |
71 | \fIswitch\fR. If \fInetdev\fR is specified, only the statistics | |
72 | associated with that device will be printed. \fInetdev\fR can be an | |
73 | OpenFlow assigned port number or device name, e.g. \fBeth0\fR. | |
a9b4a41a | 74 | . |
064af421 | 75 | .TP |
4e312e69 | 76 | \fBmod\-port \fIswitch\fR \fInetdev\fR \fIaction\fR |
064af421 BP |
77 | Modify characteristics of an interface monitored by \fIswitch\fR. |
78 | \fInetdev\fR can be referred to by its OpenFlow assigned port number or | |
79 | the device name, e.g. \fBeth0\fR. The \fIaction\fR may be any one of the | |
80 | following: | |
a9b4a41a | 81 | . |
064af421 BP |
82 | .RS |
83 | .IP \fBup\fR | |
84 | Enables the interface. This is equivalent to ``ifconfig up'' on a Unix | |
85 | system. | |
a9b4a41a | 86 | . |
064af421 BP |
87 | .IP \fBdown\fR |
88 | Disables the interface. This is equivalent to ``ifconfig down'' on a Unix | |
89 | system. | |
a9b4a41a | 90 | . |
064af421 BP |
91 | .IP \fBflood\fR |
92 | When a \fIflood\fR action is specified, traffic will be sent out this | |
93 | interface. This is the default posture for monitored ports. | |
a9b4a41a | 94 | . |
064af421 BP |
95 | .IP \fBnoflood\fR |
96 | When a \fIflood\fR action is specified, traffic will not be sent out | |
97 | this interface. This is primarily useful to prevent loops when a | |
98 | spanning tree protocol is not in use. | |
a9b4a41a | 99 | . |
064af421 | 100 | .RE |
a9b4a41a | 101 | . |
064af421 | 102 | .TP |
4e312e69 | 103 | \fBdump\-flows \fIswitch \fR[\fIflows\fR] |
064af421 BP |
104 | Prints to the console all flow entries in \fIswitch\fR's |
105 | tables that match \fIflows\fR. If \fIflows\fR is omitted, all flows | |
106 | in the switch are retrieved. See \fBFlow Syntax\fR, below, for the | |
107 | syntax of \fIflows\fR. The output format is described in | |
108 | \fBTable Entry Output\fR. | |
a9b4a41a | 109 | . |
064af421 | 110 | .TP |
4e312e69 | 111 | \fBdump\-aggregate \fIswitch \fR[\fIflows\fR] |
064af421 BP |
112 | Prints to the console aggregate statistics for flows in |
113 | \fIswitch\fR's tables that match \fIflows\fR. If \fIflows\fR is omitted, | |
114 | the statistics are aggregated across all flows in the switch's flow | |
115 | tables. See \fBFlow Syntax\fR, below, for the syntax of \fIflows\fR. | |
116 | The output format is descrbed in \fBTable Entry Output\fR. | |
a9b4a41a | 117 | . |
d2805da2 BP |
118 | .IP "\fBqueue\-stats \fIswitch \fR[\fIport \fR[\fIqueue\fR]]" |
119 | Prints to the console statistics for the specified \fIqueue\fR on | |
120 | \fIport\fR within \fIswitch\fR. Either of \fIport\fR or \fIqueue\fR | |
121 | or both may be omitted (or equivalently specified as \fBALL\fR). If | |
122 | both are omitted, statistics are printed for all queues on all ports. | |
123 | If only \fIqueue\fR is omitted, then statistics are printed for all | |
124 | queues on \fIport\fR; if only \fIport\fR is omitted, then statistics | |
125 | are printed for \fIqueue\fR on every port where it exists. | |
126 | . | |
064af421 | 127 | .TP |
4e312e69 | 128 | \fBadd\-flow \fIswitch flow\fR |
064af421 BP |
129 | Add the flow entry as described by \fIflow\fR to the \fIswitch\fR's |
130 | tables. The flow entry is in the format described in \fBFlow Syntax\fR, | |
131 | below. | |
a9b4a41a | 132 | . |
064af421 | 133 | .TP |
4e312e69 | 134 | \fBadd\-flows \fIswitch file\fR |
064af421 BP |
135 | Add flow entries as described in \fIfile\fR to \fIswitch\fR's |
136 | tables. Each line in \fIfile\fR is a flow entry in the format | |
137 | described in \fBFlow Syntax\fR, below. | |
a9b4a41a | 138 | . |
064af421 | 139 | .TP |
4e312e69 | 140 | \fBmod\-flows \fIswitch flow\fR |
064af421 | 141 | Modify the actions in entries from the \fIswitch\fR's tables |
4e312e69 | 142 | that match \fIflow\fR. When invoked with the \fB\-\-strict\fR option, |
064af421 BP |
143 | wildcards are not treated as active for matching purposes. See |
144 | \fBFlow Syntax\fR, below, for the syntax of \fIflows\fR. | |
a9b4a41a | 145 | . |
064af421 | 146 | .TP |
4e312e69 | 147 | \fBdel\-flows \fIswitch \fR[\fIflow\fR] |
064af421 | 148 | Deletes entries from the \fIswitch\fR's tables that match |
4e312e69 | 149 | \fIflow\fR. When invoked with the \fB\-\-strict\fR option, wildcards are |
064af421 | 150 | not treated as active for matching purposes. If \fIflow\fR is |
4e312e69 | 151 | omitted and the \fB\-\-strict\fR option is not used, all flows in the |
064af421 BP |
152 | switch's tables are removed. See \fBFlow Syntax\fR, below, for the |
153 | syntax of \fIflows\fR. | |
a9b4a41a | 154 | . |
0caf6bde BP |
155 | .IP "\fBsnoop \fIswitch\fR" |
156 | Connects to \fIswitch\fR and prints to the console all OpenFlow | |
157 | messages received. Unlike other \fBovs\-ofctl\fR commands, if | |
158 | \fIswitch\fR is the name of a bridge, then the \fBsnoop\fR command | |
159 | connects to a Unix domain socket named | |
160 | \fB@RUNDIR@/\fIbridge\fB.snoop\fR. \fBovs\-vswitchd\fR listens on | |
161 | such a socket for each bridge and sends to it all of the OpenFlow | |
162 | messages sent to or received from its configured OpenFlow controller. | |
163 | Thus, this command can be used to view OpenFlow protocol activity | |
164 | between a switch and its controller. | |
165 | .IP | |
166 | When a switch has more than one controller configured, only the | |
e2bfacb6 BP |
167 | traffic to and from a single controller is output. If none of the |
168 | controllers is configured as a master or a slave (using a Nicira | |
169 | extension to OpenFlow), then a controller is chosen arbitrarily among | |
170 | them. If there is a master controller, it is chosen; otherwise, if | |
171 | there are any controllers that are not masters or slaves, one is | |
172 | chosen arbitrarily; otherwise, a slave controller is chosen | |
173 | arbitrarily. This choice is made once at connection time and does not | |
174 | change as controllers reconfigure their roles. | |
175 | .IP | |
176 | If a switch has no controller configured, or if | |
0caf6bde BP |
177 | the configured controller is disconnected, no traffic is sent, so |
178 | monitoring will not show any traffic. | |
179 | . | |
180 | .IQ "\fBmonitor \fIswitch\fR [\fImiss-len\fR]" | |
064af421 BP |
181 | Connects to \fIswitch\fR and prints to the console all OpenFlow |
182 | messages received. Usually, \fIswitch\fR should specify a connection | |
4e312e69 | 183 | named on \fBovs\-openflowd\fR(8)'s \fB\-l\fR or \fB\-\-listen\fR command line |
064af421 | 184 | option. |
a9b4a41a | 185 | .IP |
064af421 BP |
186 | If \fImiss-len\fR is provided, \fBovs\-ofctl\fR sends an OpenFlow ``set |
187 | configuration'' message at connection setup time that requests | |
0caf6bde BP |
188 | \fImiss-len\fR bytes of each packet that misses the flow table. Open vSwitch |
189 | does not send these and other asynchronous messages to an | |
064af421 | 190 | \fBovs\-ofctl monitor\fR client connection unless a nonzero value is |
0caf6bde BP |
191 | specified on this argument. (Thus, if \fImiss\-len\fR is not |
192 | specified, very little traffic will ordinarily be printed.) | |
a9b4a41a | 193 | .IP |
064af421 BP |
194 | This command may be useful for debugging switch or controller |
195 | implementations. | |
a9b4a41a | 196 | . |
064af421 | 197 | .SS "OpenFlow Switch and Controller Commands" |
a9b4a41a | 198 | . |
064af421 BP |
199 | The following commands, like those in the previous section, may be |
200 | applied to OpenFlow switches, using any of the connection methods | |
201 | described in that section. Unlike those commands, these may also be | |
202 | applied to OpenFlow controllers. | |
a9b4a41a | 203 | . |
064af421 BP |
204 | .TP |
205 | \fBprobe \fItarget\fR | |
206 | Sends a single OpenFlow echo-request message to \fItarget\fR and waits | |
4e312e69 | 207 | for the response. With the \fB\-t\fR or \fB\-\-timeout\fR option, this |
064af421 BP |
208 | command can test whether an OpenFlow switch or controller is up and |
209 | running. | |
a9b4a41a | 210 | . |
064af421 BP |
211 | .TP |
212 | \fBping \fItarget \fR[\fIn\fR] | |
213 | Sends a series of 10 echo request packets to \fItarget\fR and times | |
214 | each reply. The echo request packets consist of an OpenFlow header | |
215 | plus \fIn\fR bytes (default: 64) of randomly generated payload. This | |
216 | measures the latency of individual requests. | |
a9b4a41a | 217 | . |
064af421 BP |
218 | .TP |
219 | \fBbenchmark \fItarget n count\fR | |
220 | Sends \fIcount\fR echo request packets that each consist of an | |
221 | OpenFlow header plus \fIn\fR bytes of payload and waits for each | |
222 | response. Reports the total time required. This is a measure of the | |
223 | maximum bandwidth to \fItarget\fR for round-trips of \fIn\fR-byte | |
224 | messages. | |
a9b4a41a | 225 | . |
064af421 | 226 | .SS "Flow Syntax" |
a9b4a41a | 227 | .PP |
064af421 BP |
228 | Some \fBovs\-ofctl\fR commands accept an argument that describes a flow or |
229 | flows. Such flow descriptions comprise a series | |
230 | \fIfield\fB=\fIvalue\fR assignments, separated by commas or white | |
231 | space. (Embedding spaces into a flow description normally requires | |
232 | quoting to prevent the shell from breaking the description into | |
233 | multiple arguments.) | |
a9b4a41a | 234 | .PP |
0b3f2725 BP |
235 | Flow descriptions should be in \fBnormal form\fR. This means that a |
236 | flow may only specify a value for an L3 field if it also specifies a | |
237 | particular L2 protocol, and that a flow may only specify an L4 field | |
238 | if it also specifies particular L2 and L3 protocol types. For | |
239 | example, if the L2 protocol type \fBdl_type\fR is wildcarded, then L3 | |
240 | fields \fBnw_src\fR, \fBnw_dst\fR, and \fBnw_proto\fR must also be | |
241 | wildcarded. Similarly, if \fBdl_type\fR or \fBnw_proto\fR (the L3 | |
242 | protocol type) is wildcarded, so must be \fBtp_dst\fR and | |
243 | \fBtp_src\fR, which are L4 fields. \fBovs\-ofctl\fR will warn about | |
244 | flows not in normal form. | |
245 | .PP | |
064af421 BP |
246 | The following field assignments describe how a flow matches a packet. |
247 | If any of these assignments is omitted from the flow syntax, the field | |
248 | is treated as a wildcard; thus, if all of them are omitted, the | |
249 | resulting flow matches all packets. The string \fB*\fR or \fBANY\fR | |
250 | may be specified to explicitly mark any of these fields as a wildcard. | |
251 | (\fB*\fR should be quoted to protect it from shell expansion.) | |
a9b4a41a | 252 | . |
064af421 BP |
253 | .IP \fBin_port=\fIport_no\fR |
254 | Matches physical port \fIport_no\fR. Switch ports are numbered as | |
255 | displayed by \fBovs\-ofctl show\fR. | |
a9b4a41a | 256 | . |
064af421 | 257 | .IP \fBdl_vlan=\fIvlan\fR |
f30f26be JP |
258 | Matches IEEE 802.1q Virtual LAN tag \fIvlan\fR. Specify \fB0xffff\fR |
259 | as \fIvlan\fR to match packets that are not tagged with a Virtual LAN; | |
064af421 BP |
260 | otherwise, specify a number between 0 and 4095, inclusive, as the |
261 | 12-bit VLAN ID to match. | |
a9b4a41a | 262 | . |
959a2ecd JP |
263 | .IP \fBdl_vlan_pcp=\fIpriority\fR |
264 | Matches IEEE 802.1q Priority Code Point (PCP) \fIpriority\fR, which is | |
265 | specified as a value between 0 and 7, inclusive. A higher value | |
266 | indicates a higher frame priority level. | |
a9b4a41a | 267 | . |
ed951f15 BP |
268 | .IP \fBdl_src=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
269 | .IQ \fBdl_dst=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
270 | Matches an Ethernet source (or destination) address specified as 6 | |
271 | pairs of hexadecimal digits delimited by colons | |
272 | (e.g. \fB00:0A:E4:25:6B:B0\fR). | |
273 | . | |
064af421 BP |
274 | .IP \fBdl_type=\fIethertype\fR |
275 | Matches Ethernet protocol type \fIethertype\fR, which is specified as an | |
276 | integer between 0 and 65535, inclusive, either in decimal or as a | |
277 | hexadecimal number prefixed by \fB0x\fR (e.g. \fB0x0806\fR to match ARP | |
278 | packets). | |
a9b4a41a | 279 | . |
064af421 | 280 | .IP \fBnw_src=\fIip\fR[\fB/\fInetmask\fR] |
ed951f15 BP |
281 | .IQ \fBnw_dst=\fIip\fR[\fB/\fInetmask\fR] |
282 | When \fBdl_type\fR is 0x0800 (possibly via shorthand, e.g. \fBip\fR | |
283 | or \fBtcp\fR), matches IPv4 source (or destination) address \fIip\fR, | |
284 | which may be specified as an IP address or host name | |
285 | (e.g. \fB192.168.1.1\fR or \fBwww.example.com\fR). The optional | |
286 | \fInetmask\fR allows restricting a match to an IPv4 address prefix. | |
287 | The netmask may be specified as a dotted quad | |
288 | (e.g. \fB192.168.1.0/255.255.255.0\fR) or as a CIDR block | |
064af421 | 289 | (e.g. \fB192.168.1.0/24\fR). |
ed951f15 BP |
290 | .IP |
291 | When \fBdl_type=0x0806\fR or \fBarp\fR is specified, matches the | |
292 | \fBar_spa\fR or \fBar_tpa\fR field, respectively, in ARP packets for | |
293 | IPv4 and Ethernet. | |
294 | .IP | |
295 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800 | |
0b3f2725 BP |
296 | or 0x0806, the values of \fBnw_src\fR and \fBnw_dst\fR are ignored |
297 | (see \fBFlow Syntax\fR above). | |
a9b4a41a | 298 | . |
064af421 | 299 | .IP \fBnw_proto=\fIproto\fR |
ed951f15 BP |
300 | When \fBip\fR or \fBdl_type=0x0800\fR is specified, matches IP |
301 | protocol type \fIproto\fR, which is specified as a decimal number | |
d31f1109 JP |
302 | between 0 and 255, inclusive (e.g. 1 to match ICMP packets or 6 to match |
303 | TCP packets). | |
304 | .IP | |
305 | When \fBipv6\fR or \fBdl_type=0x86dd\fR is specified, matches IPv6 | |
306 | header type \fIproto\fR, which is specified as a decimal number between | |
307 | 0 and 255, inclusive (e.g. 58 to match ICMPv6 packets or 6 to match | |
308 | TCP). The header type is the terminal header as described in the | |
309 | \fBDESIGN\fR document. | |
ed951f15 BP |
310 | .IP |
311 | When \fBarp\fR or \fBdl_type=0x0806\fR is specified, matches the lower | |
312 | 8 bits of the ARP opcode. ARP opcodes greater than 255 are treated as | |
313 | 0. | |
314 | .IP | |
d31f1109 JP |
315 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800, |
316 | 0x0806, or 0x86dd, the value of \fBnw_proto\fR is ignored (see \fBFlow | |
0b3f2725 | 317 | Syntax\fR above). |
a9b4a41a | 318 | . |
834377ea | 319 | .IP \fBnw_tos=\fItos\fR |
d31f1109 JP |
320 | Matches IP ToS/DSCP or IPv6 traffic class field \fItos\fR, which is |
321 | specified as a decimal number between 0 and 255, inclusive. Note that | |
322 | the two lower reserved bits are ignored for matching purposes. | |
ed951f15 | 323 | .IP |
d31f1109 JP |
324 | When \fBdl_type\fR is wildcarded or set to a value other than 0x0800, |
325 | 0x0806, or 0x86dd, the value of \fBnw_tos\fR is ignored (see \fBFlow | |
326 | Syntax\fR above). | |
a9b4a41a | 327 | . |
064af421 | 328 | .IP \fBtp_src=\fIport\fR |
ed951f15 BP |
329 | .IQ \fBtp_dst=\fIport\fR |
330 | When \fBdl_type\fR and \fBnw_proto\fR specify TCP or UDP, \fBtp_src\fR | |
331 | and \fBtp_dst\fR match the UDP or TCP source or destination port | |
332 | \fIport\fR, respectively. which is specified as a decimal number | |
333 | between 0 and 65535, inclusive (e.g. 80 to match packets originating | |
064af421 | 334 | from a HTTP server). |
ed951f15 BP |
335 | .IP |
336 | When \fBdl_type\fR and \fBnw_proto\fR take other values, the values of | |
0b3f2725 | 337 | these settings are ignored (see \fBFlow Syntax\fR above). |
a9b4a41a | 338 | . |
064af421 | 339 | .IP \fBicmp_type=\fItype\fR |
ed951f15 | 340 | .IQ \fBicmp_code=\fIcode\fR |
d31f1109 JP |
341 | When \fBdl_type\fR and \fBnw_proto\fR specify ICMP or ICMPv6, \fItype\fR |
342 | matches the ICMP type and \fIcode\fR matches the ICMP code. Each is | |
343 | specified as a decimal number between 0 and 255, inclusive. | |
ed951f15 BP |
344 | .IP |
345 | When \fBdl_type\fR and \fBnw_proto\fR take other values, the values of | |
0b3f2725 | 346 | these settings are ignored (see \fBFlow Syntax\fR above). |
71e17a7a JP |
347 | . |
348 | .PP | |
d31f1109 JP |
349 | The following shorthand notations are also available: |
350 | . | |
351 | .IP \fBip\fR | |
352 | Same as \fBdl_type=0x0800\fR. | |
353 | . | |
354 | .IP \fBicmp\fR | |
355 | Same as \fBdl_type=0x0800,nw_proto=1\fR. | |
356 | . | |
357 | .IP \fBtcp\fR | |
358 | Same as \fBdl_type=0x0800,nw_proto=6\fR. | |
359 | . | |
360 | .IP \fBudp\fR | |
361 | Same as \fBdl_type=0x0800,nw_proto=17\fR. | |
362 | . | |
363 | .IP \fBarp\fR | |
364 | Same as \fBdl_type=0x0806\fR. | |
365 | . | |
366 | .PP | |
71e17a7a JP |
367 | The following field assignments require support for the NXM (Nicira |
368 | Extended Match) extension to OpenFlow. When one of these is specified, | |
369 | \fBovs\-ofctl\fR will automatically attempt to negotiate use of this | |
370 | extension. If the switch does not support NXM, then \fBovs\-ofctl\fR | |
371 | will report a fatal error. | |
372 | . | |
bad68a99 JP |
373 | .IP \fBarp_sha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR |
374 | .IQ \fBarp_tha=\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR | |
375 | When \fBdl_type\fR specifies ARP, \fBarp_sha\fR and \fBarp_tha\fR match | |
376 | the source and target hardware address, respectively. An address is | |
377 | specified as 6 pairs of hexadecimal digits delimited by colons. | |
378 | . | |
d31f1109 JP |
379 | .IP \fBipv6_src=\fIipv6\fR[\fB/\fInetmask\fR] |
380 | .IQ \fBipv6_dst=\fIipv6\fR[\fB/\fInetmask\fR] | |
381 | When \fBdl_type\fR is 0x86dd (possibly via shorthand, e.g., \fBipv6\fR | |
382 | or \fBtcp6\fR), matches IPv6 source (or destination) address \fIipv6\fR, | |
383 | which may be specified as defined in RFC 2373. The preferred format is | |
384 | \fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fB:\fIx\fR, where | |
385 | \fIx\fR are the hexadecimal values of the eight 16-bit pieces of the | |
386 | address. A single instance of \fB::\fR may be used to indicate multiple | |
387 | groups of 16-bits of zeros. The optional \fInetmask\fR allows | |
388 | restricting a match to an IPv6 address prefix. A netmask is specified | |
389 | as a CIDR block (e.g. \fB2001:db8:3c4d:1::/64\fR). | |
390 | . | |
8368c090 BP |
391 | .IP \fBtun_id=\fItunnel-id\fR[\fB/\fImask\fR] |
392 | Matches tunnel identifier \fItunnel-id\fR. Only packets that arrive | |
4c5df7f7 | 393 | over a tunnel that carries a key (e.g. GRE with the RFC 2890 key |
8368c090 | 394 | extension) will have a nonzero tunnel ID. If \fImask\fR is omitted, |
71e17a7a | 395 | \fItunnel-id\fR is the exact tunnel ID to match; if \fImask\fR is |
8368c090 BP |
396 | specified, then a 1-bit in \fImask\fR indicates that the corresponding |
397 | bit in \fItunnel-id\fR must match exactly, and a 0-bit wildcards that | |
398 | bit. | |
4c5df7f7 | 399 | .IP |
71e17a7a JP |
400 | In an attempt to be compatible with more switches, \fBovs\-ofctl\fR will |
401 | prefer to use the ``tunnel ID from cookie'' Nicira extension to NXM. | |
402 | The use of this extension comes with three caveats: the top 32 bits of | |
403 | the \fBcookie\fR (see below) are used for \fItunnel-id\fR and thus | |
404 | unavailable for other use, specifying \fBtun_id\fR on \fBdump\-flows\fR | |
405 | or \fBdump\-aggregate\fR has no effect, and \fImask\fR is not supported. | |
406 | If any of these caveats apply, \fBovs-ofctl\fR will use NXM. | |
407 | . | |
00b1c62f BP |
408 | .IP "\fBreg\fIidx\fB=\fIvalue\fR[\fB/\fImask\fR]" |
409 | Matches \fIvalue\fR either exactly or with optional \fImask\fR in | |
410 | register number \fIidx\fR. The valid range of \fIidx\fR depends on | |
411 | the switch. \fIvalue\fR and \fImask\fR are 32-bit integers, by | |
412 | default in decimal (use a \fB0x\fR prefix to specify hexadecimal). | |
413 | Arbitrary \fImask\fR values are allowed: a 1-bit in \fImask\fR | |
414 | indicates that the corresponding bit in \fIvalue\fR must match | |
415 | exactly, and a 0-bit wildcards that bit. | |
416 | .IP | |
417 | When a packet enters an OpenFlow switch, all of the registers are set | |
418 | to 0. Only explicit Nicira extension actions change register values. | |
a9b4a41a | 419 | . |
064af421 | 420 | .PP |
d31f1109 JP |
421 | Defining IPv6 flows (those with \fBdl_type\fR equal to 0x86dd) requires |
422 | support for NXM. The following shorthand notations are available for | |
423 | IPv6-related flows: | |
a9b4a41a | 424 | . |
d31f1109 JP |
425 | .IP \fBipv6\fR |
426 | Same as \fBdl_type=0x86dd\fR. | |
a9b4a41a | 427 | . |
d31f1109 JP |
428 | .IP \fBtcp6\fR |
429 | Same as \fBdl_type=0x86dd,nw_proto=6\fR. | |
a9b4a41a | 430 | . |
d31f1109 JP |
431 | .IP \fBudp6\fR |
432 | Same as \fBdl_type=0x86dd,nw_proto=17\fR. | |
a9b4a41a | 433 | . |
d31f1109 JP |
434 | .IP \fBicmp6\fR |
435 | Same as \fBdl_type=0x86dd,nw_proto=58\fR. | |
a9b4a41a | 436 | . |
064af421 | 437 | .PP |
4e312e69 | 438 | The \fBadd\-flow\fR and \fBadd\-flows\fR commands require an additional |
537eeb9c | 439 | field, which must be the final field specified: |
a9b4a41a | 440 | . |
064af421 BP |
441 | .IP \fBactions=\fR[\fItarget\fR][\fB,\fItarget\fR...]\fR |
442 | Specifies a comma-separated list of actions to take on a packet when the | |
443 | flow entry matches. If no \fItarget\fR is specified, then packets | |
444 | matching the flow are dropped. The \fItarget\fR may be a decimal port | |
445 | number designating the physical port on which to output the packet, or one | |
446 | of the following keywords: | |
a9b4a41a | 447 | . |
064af421 BP |
448 | .RS |
449 | .IP \fBoutput\fR:\fIport\fR | |
450 | Outputs the packet on the port specified by \fIport\fR. | |
a9b4a41a | 451 | . |
5682f723 BP |
452 | .IP \fBenqueue\fR:\fIport\fB:\fIqueue\fR |
453 | Enqueues the packet on the specified \fIqueue\fR within port | |
454 | \fIport\fR. The number of supported queues depends on the switch; | |
455 | some OpenFlow implementations do not support queuing at all. | |
456 | . | |
064af421 BP |
457 | .IP \fBnormal\fR |
458 | Subjects the packet to the device's normal L2/L3 processing. (This | |
459 | action is not implemented by all OpenFlow switches.) | |
a9b4a41a | 460 | . |
064af421 BP |
461 | .IP \fBflood\fR |
462 | Outputs the packet on all switch physical ports other than the port on | |
463 | which it was received and any ports on which flooding is disabled | |
464 | (typically, these would be ports disabled by the IEEE 802.1D spanning | |
465 | tree protocol). | |
a9b4a41a | 466 | . |
064af421 BP |
467 | .IP \fBall\fR |
468 | Outputs the packet on all switch physical ports other than the port on | |
469 | which it was received. | |
a9b4a41a | 470 | . |
064af421 BP |
471 | .IP \fBcontroller\fR:\fImax_len\fR |
472 | Sends the packet to the OpenFlow controller as a ``packet in'' | |
473 | message. If \fImax_len\fR is a number, then it specifies the maximum | |
474 | number of bytes that should be sent. If \fImax_len\fR is \fBALL\fR or | |
475 | omitted, then the entire packet is sent. | |
a9b4a41a | 476 | . |
064af421 BP |
477 | .IP \fBlocal\fR |
478 | Outputs the packet on the ``local port,'' which corresponds to the | |
479 | \fBof\fIn\fR network device (see \fBCONTACTING THE CONTROLLER\fR in | |
8cd4882f | 480 | \fBovs\-openflowd\fR(8) for information on the \fBof\fIn\fR network device). |
a9b4a41a | 481 | . |
064af421 BP |
482 | .IP \fBdrop\fR |
483 | Discards the packet, so no further processing or forwarding takes place. | |
484 | If a drop action is used, no other actions may be specified. | |
a9b4a41a | 485 | . |
064af421 BP |
486 | .IP \fBmod_vlan_vid\fR:\fIvlan_vid\fR |
487 | Modifies the VLAN id on a packet. The VLAN tag is added or modified | |
488 | as necessary to match the value specified. If the VLAN tag is added, | |
489 | a priority of zero is used (see the \fBmod_vlan_pcp\fR action to set | |
490 | this). | |
a9b4a41a | 491 | . |
064af421 BP |
492 | .IP \fBmod_vlan_pcp\fR:\fIvlan_pcp\fR |
493 | Modifies the VLAN priority on a packet. The VLAN tag is added or modified | |
494 | as necessary to match the value specified. Valid values are between 0 | |
495 | (lowest) and 7 (highest). If the VLAN tag is added, a vid of zero is used | |
496 | (see the \fBmod_vlan_vid\fR action to set this). | |
a9b4a41a | 497 | . |
064af421 BP |
498 | .IP \fBstrip_vlan\fR |
499 | Strips the VLAN tag from a packet if it is present. | |
a9b4a41a | 500 | . |
064af421 BP |
501 | .IP \fBmod_dl_src\fB:\fImac\fR |
502 | Sets the source Ethernet address to \fImac\fR. | |
a9b4a41a | 503 | . |
064af421 BP |
504 | .IP \fBmod_dl_dst\fB:\fImac\fR |
505 | Sets the destination Ethernet address to \fImac\fR. | |
a9b4a41a | 506 | . |
e423eca6 JP |
507 | .IP \fBmod_nw_src\fB:\fIip\fR |
508 | Sets the IPv4 source address to \fIip\fR. | |
a9b4a41a | 509 | . |
e423eca6 JP |
510 | .IP \fBmod_nw_dst\fB:\fIip\fR |
511 | Sets the IPv4 destination address to \fIip\fR. | |
a9b4a41a | 512 | . |
e423eca6 JP |
513 | .IP \fBmod_tp_src\fB:\fIport\fR |
514 | Sets the TCP or UDP source port to \fIport\fR. | |
a9b4a41a | 515 | . |
e423eca6 JP |
516 | .IP \fBmod_tp_dst\fB:\fIport\fR |
517 | Sets the TCP or UDP destination port to \fIport\fR. | |
a9b4a41a | 518 | . |
959a2ecd JP |
519 | .IP \fBmod_nw_tos\fB:\fItos\fR |
520 | Sets the IP ToS/DSCP field to \fItos\fR. Valid values are between 0 and | |
521 | 255, inclusive. Note that the two lower reserved bits are never | |
522 | modified. | |
a9b4a41a | 523 | . |
659586ef JG |
524 | .RE |
525 | .IP | |
526 | The following actions are Nicira vendor extensions that, as of this writing, are | |
527 | only known to be implemented by Open vSwitch: | |
528 | . | |
529 | .RS | |
530 | . | |
3a2fe1f3 BP |
531 | .IP \fBresubmit\fB:\fIport\fR |
532 | Re-searches the OpenFlow flow table with the \fBin_port\fR field | |
533 | replaced by \fIport\fR and executes the actions found, if any, in | |
534 | addition to any other actions in this flow entry. Recursive | |
535 | \fBresubmit\fR actions are ignored. | |
659586ef JG |
536 | . |
537 | .IP \fBset_tunnel\fB:\fIid\fR | |
b9298d3f BP |
538 | .IQ \fBset_tunnel64\fB:\fIid\fR |
539 | If outputting to a port that encapsulates the packet in a tunnel and | |
540 | supports an identifier (such as GRE), sets the identifier to \fBid\fR. | |
541 | If the \fBset_tunnel\fR form is used and \fIid\fR fits in 32 bits, | |
542 | then this uses an action extension that is supported by Open vSwitch | |
543 | 1.0 and later. Otherwise, if \fIid\fR is a 64-bit value, it requires | |
544 | Open vSwitch 1.1 or later. | |
3a2fe1f3 | 545 | . |
933df876 BP |
546 | .IP \fBdrop_spoofed_arp\fR |
547 | Stops processing further actions, if the packet being processed is an | |
548 | Ethernet+IPv4 ARP packet for which the source Ethernet address inside | |
549 | the ARP packet differs from the source Ethernet address in the | |
550 | Ethernet header. | |
bad68a99 JP |
551 | .IP |
552 | This action is deprecated in favor of defining flows using the | |
553 | \fBarp_sha\fR match field described earlier and will likely be removed | |
554 | in a future version of Open vSwitch. | |
eedc0097 JP |
555 | . |
556 | .IP \fBset_queue\fB:\fIqueue\fR | |
557 | Sets the queue that should be used to \fIqueue\fR when packets are | |
558 | output. The number of supported queues depends on the switch; some | |
559 | OpenFlow implementations do not support queuing at all. | |
560 | . | |
561 | .IP \fBpop_queue\fR | |
562 | Restores the queue to the value it was before any \fBset_queue\fR | |
563 | actions were applied. | |
564 | . | |
96fc46e8 BP |
565 | .IP \fBnote:\fR[\fIhh\fR]... |
566 | Does nothing at all. Any number of bytes represented as hex digits | |
567 | \fIhh\fR may be included. Pairs of hex digits may be separated by | |
568 | periods for readability. | |
f393f81e BP |
569 | . |
570 | .IP "\fBmove:\fIsrc\fB[\fIstart\fB..\fIend\fB]->\fIdst\fB[\fIstart\fB..\fIend\fB]\fR" | |
571 | Copies the named bits from field \fIsrc\fR to field \fIdst\fR. | |
572 | \fIsrc\fR and \fIdst\fR must be NXM field names as defined in | |
573 | \fBnicira\-ext.h\fR, e.g. \fBNXM_OF_UDP_SRC\fR or \fBNXM_NX_REG0\fR. | |
574 | Each \fIstart\fR and \fIend\fR pair, which are inclusive, must specify | |
575 | the same number of bits and must fit within its respective field. | |
576 | Shorthands for \fB[\fIstart\fB..\fIend\fB]\fR exist: use | |
577 | \fB[\fIbit\fB]\fR to specify a single bit or \fB[]\fR to specify an | |
578 | entire field. | |
579 | .IP | |
580 | Examples: \fBmove:NXM_NX_REG0[0..5]\->NXM_NX_REG1[26..31]\fR copies the | |
581 | six bits numbered 0 through 5, inclusive, in register 0 into bits 26 | |
582 | through 31, inclusive; | |
583 | \fBmove:NXM_NX_REG0[0..15]->NXM_OF_VLAN_TCI[]\fR copies the least | |
584 | significant 16 bits of register 0 into the VLAN TCI field. | |
585 | . | |
586 | .IP "\fBload:\fIvalue\fB\->\fIdst\fB[\fIstart\fB..\fIend\fB]" | |
587 | Writes \fIvalue\fR to bits \fIstart\fR through \fIend\fR, inclusive, | |
588 | in field \fBdst\fR. | |
589 | .IP | |
590 | Example: \fBload:55\->NXM_NX_REG2[0..5]\fR loads value 55 (bit pattern | |
591 | \fB110111\fR) into bits 0 through 5, inclusive, in register 2. | |
53ddd40a BP |
592 | . |
593 | .IP "\fBmultipath(\fIfields\fB, \fIbasis\fB, \fIalgorithm\fB, \fIn_links\fB, \fIarg\fB, \fIdst\fB[\fIstart\fB..\fIend\fB])\fR" | |
594 | Hashes \fIfields\fR using \fIbasis\fR as a universal hash parameter, | |
595 | then the applies multipath link selection \fIalgorithm\fR (with | |
596 | parameter \fIarg\fR) to choose one of \fIn_links\fR output links | |
597 | numbered 0 through \fIn_links\fR minus 1, and stores the link into | |
598 | \fIdst\fB[\fIstart\fB..\fIend\fB]\fR, which must be an NXM register as | |
599 | described above. | |
600 | .IP | |
601 | Currently, \fIfields\fR must be either \fBeth_src\fR or | |
602 | \fBsymmetric_l4\fR and \fIalgorithm\fR must be one of \fBmodulo_n\fR, | |
603 | \fBhash_threshold\fR, \fBhrw\fR, and \fBiter_hash\fR. Only | |
604 | the \fBiter_hash\fR algorithm uses \fIarg\fR. | |
605 | .IP | |
606 | Refer to \fBnicira\-ext.h\fR for more details. | |
064af421 | 607 | .RE |
a9b4a41a | 608 | . |
064af421 BP |
609 | .IP |
610 | (The OpenFlow protocol supports other actions that \fBovs\-ofctl\fR does | |
611 | not yet expose to the user.) | |
a9b4a41a | 612 | . |
064af421 | 613 | .PP |
8cce2125 JP |
614 | The \fBadd\-flow\fR, \fBadd\-flows\fR, and \fBmod\-flows\fR commands |
615 | support an additional optional field: | |
616 | . | |
617 | .IP \fBcookie=\fIvalue\fR | |
618 | . | |
619 | A cookie is an opaque identifier that can be associated with the flow. | |
620 | \fIvalue\fR can be any 64-bit number and need not be unique among | |
621 | flows. | |
622 | . | |
623 | .PP | |
4b6b46ce BP |
624 | The following additional field sets the priority for flows added by |
625 | the \fBadd\-flow\fR and \fBadd\-flows\fR commands. For | |
626 | \fBmod\-flows\fR and \fBdel\-flows\fR when \fB\-\-strict\fR is | |
627 | specified, priority must match along with the rest of the flow | |
628 | specification. Other commands ignore the priority value. | |
a9b4a41a | 629 | . |
064af421 BP |
630 | .IP \fBpriority=\fIvalue\fR |
631 | The priority at which a wildcarded entry will match in comparison to | |
632 | others. \fIvalue\fR is a number between 0 and 65535, inclusive. A higher | |
633 | \fIvalue\fR will match before a lower one. An exact-match entry will always | |
634 | have priority over an entry containing wildcards, so it has an implicit | |
635 | priority value of 65535. When adding a flow, if the field is not specified, | |
636 | the flow's priority will default to 32768. | |
a9b4a41a | 637 | . |
064af421 | 638 | .PP |
4e312e69 | 639 | The \fBadd\-flow\fR and \fBadd\-flows\fR commands support additional |
064af421 | 640 | optional fields: |
a9b4a41a | 641 | . |
064af421 BP |
642 | .TP |
643 | \fBidle_timeout=\fIseconds\fR | |
644 | Causes the flow to expire after the given number of seconds of | |
a1545337 BP |
645 | inactivity. A value of 0 (the default) prevents a flow from expiring due to |
646 | inactivity. | |
a9b4a41a | 647 | . |
064af421 BP |
648 | .IP \fBhard_timeout=\fIseconds\fR |
649 | Causes the flow to expire after the given number of seconds, | |
650 | regardless of activity. A value of 0 (the default) gives the flow no | |
651 | hard expiration deadline. | |
a9b4a41a | 652 | . |
064af421 | 653 | .PP |
4e312e69 BP |
654 | The \fBdump\-flows\fR, \fBdump\-aggregate\fR, \fBdel\-flow\fR |
655 | and \fBdel\-flows\fR commands support one additional optional field: | |
a9b4a41a | 656 | . |
064af421 BP |
657 | .TP |
658 | \fBout_port=\fIport\fR | |
659 | If set, a matching flow must include an output action to \fIport\fR. | |
a9b4a41a | 660 | . |
064af421 | 661 | .PP |
4e312e69 | 662 | The \fBdump\-flows\fR and \fBdump\-aggregate\fR commands support an |
064af421 | 663 | additional optional field: |
a9b4a41a | 664 | . |
064af421 BP |
665 | .IP \fBtable=\fInumber\fR |
666 | If specified, limits the flows about which statistics are gathered to | |
667 | those in the table with the given \fInumber\fR. Tables are numbered | |
4e312e69 | 668 | as shown by the \fBdump\-tables\fR command. |
a9b4a41a | 669 | . |
064af421 BP |
670 | If this field is not specified, or if \fInumber\fR is given as |
671 | \fB255\fR, statistics are gathered about flows from all tables. | |
a9b4a41a | 672 | . |
064af421 | 673 | .SS "Table Entry Output" |
a9b4a41a | 674 | . |
4e312e69 | 675 | The \fBdump\-tables\fR and \fBdump\-aggregate\fR commands print information |
064af421 BP |
676 | about the entries in a datapath's tables. Each line of output is a |
677 | unique flow entry, which begins with some common information: | |
a9b4a41a | 678 | . |
064af421 BP |
679 | .IP \fBduration\fR |
680 | The number of seconds the entry has been in the table. | |
a9b4a41a | 681 | . |
064af421 BP |
682 | .IP \fBtable_id\fR |
683 | The table that contains the flow. When a packet arrives, the switch | |
684 | begins searching for an entry at the lowest numbered table. Tables are | |
4e312e69 | 685 | numbered as shown by the \fBdump\-tables\fR command. |
a9b4a41a | 686 | . |
064af421 BP |
687 | .IP \fBpriority\fR |
688 | The priority of the entry in relation to other entries within the same | |
689 | table. A higher value will match before a lower one. | |
a9b4a41a | 690 | . |
064af421 BP |
691 | .IP \fBn_packets\fR |
692 | The number of packets that have matched the entry. | |
a9b4a41a | 693 | . |
064af421 BP |
694 | .IP \fBn_bytes\fR |
695 | The total number of bytes from packets that have matched the entry. | |
a9b4a41a | 696 | . |
064af421 BP |
697 | .PP |
698 | The rest of the line consists of a description of the flow entry as | |
699 | described in \fBFlow Syntax\fR, above. | |
a9b4a41a BP |
700 | . |
701 | . | |
064af421 BP |
702 | .SH OPTIONS |
703 | .TP | |
4e312e69 | 704 | \fB\-\-strict\fR |
064af421 | 705 | Uses strict matching when running flow modification commands. |
a9b4a41a | 706 | . |
88ca35ee BP |
707 | .IP "\fB\-F \fIformat\fR" |
708 | .IQ "\fB\-\-flow\-format=\fIformat\fR" | |
709 | \fBovs\-ofctl\fR supports the following flow formats, in order of | |
710 | increasing capability: | |
711 | .RS | |
712 | .IP "\fBopenflow10\fR" | |
713 | This is the standard OpenFlow 1.0 flow format. It should be supported | |
714 | by all OpenFlow switches. | |
715 | . | |
716 | .IP "\fBtun_id_from_cookie\fR" | |
717 | This Nicira extension to OpenFlow adds minimal and limited support for | |
718 | \fBtun_id\fR, but it does not support any other Nicira flow | |
719 | extensions. (This flow format is deprecated.) | |
720 | . | |
721 | .IP "\fBnxm\fR (Nicira Extended Match)" | |
722 | This Nicira extension to OpenFlow is flexible and extensible. It | |
723 | supports all of the Nicira flow extensions, such as \fBtun_id\fR and | |
724 | registers. | |
725 | .RE | |
726 | .IP | |
727 | Usually, \fBovs\-ofctl\fR picks the correct format automatically. For | |
728 | commands that modify the flow table, \fBovs\-ofctl\fR by default uses | |
729 | the most widely supported flow format that supports the flows being | |
730 | added. For commands that query the flow table, \fBovs\-ofctl\fR by | |
731 | default queries and uses the most advanced format supported by the | |
732 | switch. | |
733 | .IP | |
734 | This option, where \fIformat\fR is one of the formats listed in the | |
735 | above table, overrides \fBovs\-ofctl\fR's default choice of flow | |
736 | format. If a command cannot work as requested using the requested | |
737 | flow format, \fBovs\-ofctl\fR will report a fatal error. | |
4f564f8d BP |
738 | . |
739 | .IP "\fB\-m\fR" | |
740 | .IQ "\fB\-\-more\fR" | |
741 | Increases the verbosity of OpenFlow messages printed and logged by | |
742 | \fBovs\-ofctl\fR commands. Specify this option more than once to | |
743 | increase verbosity further. | |
ac300505 | 744 | .SS "Public Key Infrastructure Options" |
84ee7bcf | 745 | .so lib/ssl.man |
064af421 BP |
746 | .so lib/vlog.man |
747 | .so lib/common.man | |
a9b4a41a | 748 | . |
064af421 | 749 | .SH EXAMPLES |
a9b4a41a | 750 | . |
064af421 BP |
751 | The following examples assume that an OpenFlow switch on the local |
752 | host has been configured to listen for management connections on a | |
753 | Unix domain socket named \fB@RUNDIR@/openflow.sock\fR, e.g. by | |
4e312e69 | 754 | specifying \fB\-\-listen=punix:@RUNDIR@/openflow.sock\fR on the |
8cd4882f | 755 | \fBovs\-openflowd\fR(8) command line. |
a9b4a41a | 756 | . |
064af421 | 757 | .TP |
4e312e69 | 758 | \fBovs\-ofctl dump\-tables unix:@RUNDIR@/openflow.sock\fR |
064af421 BP |
759 | Prints out the switch's table stats. (This is more interesting after |
760 | some traffic has passed through.) | |
a9b4a41a | 761 | . |
064af421 | 762 | .TP |
4e312e69 | 763 | \fBovs\-ofctl dump\-flows unix:@RUNDIR@/openflow.sock\fR |
064af421 | 764 | Prints the flow entries in the switch. |
a9b4a41a | 765 | . |
064af421 | 766 | .SH "SEE ALSO" |
a9b4a41a | 767 | . |
064af421 BP |
768 | .BR ovs\-appctl (8), |
769 | .BR ovs\-controller (8), | |
770 | .BR ovs\-vswitchd (8) |