1 .TH ovs\-openflowd 8 "March 2009" "Open vSwitch" "Open vSwitch Manual"
5 ovs\-openflowd \- OpenFlow switch implementation
9 [\fIoptions\fR] \fIdatapath\fR [\fIcontroller\fR]
12 The \fBovs\-openflowd\fR program implements an OpenFlow switch using a
13 flow-based datapath. \fBovs\-openflowd\fR connects to an OpenFlow controller
16 The mandatory \fIdatapath\fR argument argument specifies the local datapath
17 to relay. It takes one of the following forms:
22 The optional \fIcontroller\fR argument specifies how to connect to
23 the OpenFlow controller. It takes one of the following forms:
25 .so lib/vconn-active.man
28 If \fIcontroller\fR is omitted, \fBovs\-openflowd\fR attempts to discover the
29 location of the controller automatically (see below).
31 .SS "Contacting the Controller"
32 The OpenFlow switch must be able to contact the OpenFlow controller
33 over the network. It can do so in one of two ways:
36 In this configuration, OpenFlow traffic uses a network separate from
37 the data traffic that it controls, that is, the switch does not use
38 any of the network devices added to the datapath with \fBovs\-dpctl
39 add\-if\fR in its communication with the controller.
41 To use \fBovs\-openflowd\fR in a network with out-of-band control, specify
42 \fB--out-of-band\fR on the \fBovs\-openflowd\fR command line. The control
43 network must be configured separately, before or after \fBovs\-openflowd\fR
47 In this configuration, a single network is used for OpenFlow traffic
48 and other data traffic, that is, the switch contacts the controller
49 over one of the network devices added to the datapath with \fBovs\-dpctl
50 add\-if\fR. This configuration is often more convenient than
51 out-of-band control, because it is not necessary to maintain two
54 In-band control is the default for \fBovs\-openflowd\fR, so no special
55 command-line option is required.
57 With in-band control, the location of the controller can be configured
58 manually or discovered automatically:
61 .IP "controller discovery"
62 To make \fBovs\-openflowd\fR discover the location of the controller
63 automatically, do not specify the location of the controller on the
64 \fBovs\-openflowd\fR command line.
66 In this mode, \fBovs\-openflowd\fR will broadcast a DHCP request with vendor
67 class identifier \fBOpenFlow\fR across the network devices added to
68 the datapath with \fBovs\-dpctl add\-if\fR. It will accept any valid DHCP
69 reply that has the same vendor class identifier and includes a
70 vendor-specific option with code 1 whose contents are a string
71 specifying the location of the controller in the same format used on
72 the \fBovs\-openflowd\fR command line (e.g. \fBssl:192.168.0.1\fR).
74 The DHCP reply may also, optionally, include a vendor-specific option
75 with code 2 whose contents are a string specifying the URI to the base
76 of the OpenFlow PKI (e.g. \fBhttp://192.168.0.1/openflow/pki\fR).
77 This URI is used only for bootstrapping the OpenFlow PKI at initial
78 switch setup; \fBovs\-openflowd\fR does not use it at all.
80 The following ISC DHCP server configuration file assigns the IP
81 address range 192.168.0.20 through 192.168.0.30 to OpenFlow switches
82 that follow the switch protocol and addresses 192.168.0.1 through
83 192.168.0.10 to all other DHCP clients:
85 default-lease-time 600;
89 option space openflow;
91 option openflow.controller-vconn code 1 = text;
93 option openflow.pki-uri code 2 = text;
97 match if option vendor-class-identifier = "OpenFlow";
99 vendor-option-space openflow;
101 option openflow.controller-vconn "tcp:192.168.0.10";
103 option openflow.pki-uri "http://192.168.0.10/openflow/pki";
105 option vendor-class-identifier "OpenFlow";
109 subnet 192.168.0.0 netmask 255.255.255.0 {
113 allow members of "OpenFlow";
115 range 192.168.0.20 192.168.0.30;
121 deny members of "OpenFlow";
123 range 192.168.0.1 192.168.0.10;
130 .IP "manual configuration"
131 To configure in-band control manually, specify the location of the
132 controller on the \fBovs\-openflowd\fR command line as the \fIcontroller\fR
133 argument. You must also configure the network device for the OpenFlow
134 ``local port'' to allow \fBovs\-openflowd\fR to connect to that controller.
135 The OpenFlow local port is a virtual network port that \fBovs\-openflowd\fR
136 bridges to the physical switch ports. The name of the local port for
137 a given \fIdatapath\fR may be seen by running \fBovs\-dpctl show
138 \fIdatapath\fR; the local port is listed as port 0 in \fBshow\fR's
142 Before \fBovs\-openflowd\fR starts, the local port network device is not
143 bridged to any physical network, so the next step depends on whether
144 connectivity is required to configure the device's IP address. If the
145 switch has a static IP address, you may configure its IP address now
146 with a command such as
147 .B ifconfig of0 192.168.1.1
148 and then invoke \fBovs\-openflowd\fR.
150 On the other hand, if the switch does not have a static IP address,
151 e.g. it obtains its IP address dynamically via DHCP, the DHCP client
152 will not be able to contact the DHCP server until the OpenFlow switch
153 has started up. Thus, start \fBovs\-openflowd\fR without configuring
154 the local port network device, and start the DHCP client afterward.
158 .SS "Controller Discovery Options"
160 \fB--accept-vconn=\fIregex\fR
161 When \fBovs\-openflowd\fR performs controller discovery (see \fBContacting
162 the Controller\fR, above, for more information about controller
163 discovery), it validates the controller location obtained via DHCP
164 with a POSIX extended regular expression. Only controllers whose
165 names match the regular expression will be accepted.
167 The default regular expression is \fBssl:.*\fR (meaning that only SSL
168 controller connections will be accepted) when any of the SSL
169 configuration options \fB--private-key\fR, \fB--certificate\fR, or
170 \fB--ca-cert\fR is specified. The default is \fB^tcp:.*\fR otherwise
171 (meaning that only TCP controller connections will be accepted).
173 The \fIregex\fR is implicitly anchored at the beginning of the
174 controller location string, as if it begins with \fB^\fR.
176 When controller discovery is not performed, this option has no effect.
179 \fB--no-resolv-conf\fR
180 When \fBovs\-openflowd\fR performs controller discovery (see \fBContacting
181 the Controller\fR, above, for more information about controller
182 discovery), by default it overwrites the system's
183 \fB/etc/resolv.conf\fR with domain information and DNS servers
184 obtained via DHCP. If the location of the controller is specified
185 using a hostname, rather than an IP address, and the network's DNS
186 servers ever change, this behavior is essential. But because it also
187 interferes with any administrator or process that manages
188 \fB/etc/resolv.conf\fR, when this option is specified, \fBovs\-openflowd\fR
189 will not modify \fB/etc/resolv.conf\fR.
191 \fBovs\-openflowd\fR will only modify \fBresolv.conf\fR if the DHCP response
192 that it receives specifies one or more DNS servers.
194 When controller discovery is not performed, this option has no effect.
196 .SS "Networking Options"
198 \fB--datapath-id=\fIdpid\fR
199 Sets \fIdpid\fR, which must consist of exactly 12 hexadecimal digits,
200 as the datapath ID that the switch will use to identify itself to the
203 If this option is omitted, the default datapath ID is taken from the
204 Ethernet address of the datapath's local port (which is typically
208 \fB--mgmt-id=\fImgmtid\fR
209 Sets \fImgmtid\fR, which must consist of exactly 12 hexadecimal
210 digits, as the switch's management ID.
212 If this option is omitted, the management ID defaults to 0, signaling
213 to the controller that management is supported but not configured.
216 \fB--fail=\fR[\fBopen\fR|\fBclosed\fR]
217 The controller is, ordinarily, responsible for setting up all flows on
218 the OpenFlow switch. Thus, if the connection to the controller fails,
219 no new network connections can be set up. If the connection to the
220 controller stays down long enough, no packets can pass through the
223 If this option is set to \fBopen\fR (the default), \fBovs\-openflowd\fR will
224 take over responsibility for setting up flows in the local datapath
225 when no message has been received from the controller for three times
226 the inactivity probe interval (see below), or 45 seconds by default.
227 In this ``fail open'' mode, \fBovs\-openflowd\fR causes the datapath to act
228 like an ordinary MAC-learning switch. \fBovs\-openflowd\fR will continue to
229 retry connection to the controller in the background and, when the
230 connection succeeds, it discontinues its fail-open behavior.
232 If this option is set to \fBclosed\fR, then \fBovs\-openflowd\fR will not
233 set up flows on its own when the controller connection fails.
236 \fB--inactivity-probe=\fIsecs\fR
237 When the OpenFlow switch is connected to the controller, the
238 switch waits for a message to be received from the controller for
239 \fIsecs\fR seconds before it sends a inactivity probe to the
240 controller. After sending the inactivity probe, if no response is
241 received for an additional \fIsecs\fR seconds, the switch
242 assumes that the connection has been broken and attempts to reconnect.
243 The default and the minimum value are both 5 seconds.
245 When fail-open mode is configured, changing the inactivity probe
246 interval also changes the interval before entering fail-open mode (see
250 \fB--max-idle=\fIsecs\fR|\fBpermanent\fR
251 Sets \fIsecs\fR as the number of seconds that a flow set up by the
252 OpenFlow switch will remain in the switch's flow table without any
253 matching packets being seen. If \fBpermanent\fR is specified, which
254 is not recommended, flows set up by the switch will never
255 expire. The default is 15 seconds.
257 Most flows are set up by the OpenFlow controller, not by the
258 switch. This option affects only the following flows, which the
259 OpenFlow switch sets up itself:
263 When \fB--fail=open\fR is specified, flows set up when the
264 switch has not been able to contact the controller for the configured
268 When in-band control is in use, flows set up to bootstrap contacting
269 the controller (see \fBContacting the Controller\fR, above, for
270 more information about in-band control).
274 As a result, when both \fB--fail=closed\fR and \fB--out-of-band\fR are
275 specified, this option has no effect.
278 \fB--max-backoff=\fIsecs\fR
279 Sets the maximum time between attempts to connect to the controller to
280 \fIsecs\fR, which must be at least 1. The actual interval between
281 connection attempts starts at 1 second and doubles on each failing
282 attempt until it reaches the maximum. The default maximum backoff
286 \fB-l\fR, \fB--listen=\fImethod\fR
287 By default, the switch listens for OpenFlow management connections on a
288 Unix domain socket named \fB@RUNDIR@/\fIdatapath\fB.mgmt\fR. This socket
289 can be used to perform local OpenFlow monitoring and administration with
290 tools such as \fBovs\-ofctl\fR.
292 This option may be used to override the default listener. The \fImethod\fR
293 must be given as one of the passive OpenFlow connection methods listed
294 below. This option may be specified multiple times to listen to
295 multiple connection methods. If a single \fImethod\fR of \fBnone\fR is
296 used, no listeners will be created.
299 .so lib/vconn-passive.man
303 \fB--snoop=\fImethod\fR
304 Configures the switch to additionally listen for incoming OpenFlow
305 connections for controller connection snooping. The \fImethod\fR must
306 be given as one of the passive OpenFlow connection methods listed
307 under the \fB--listen\fR option above. This option may be specified
308 multiple times to listen to multiple connection methods.
310 If \fBovs\-ofctl monitor\fR is used to connect to \fImethod\fR specified on
311 \fB--snoop\fR, it will display all the OpenFlow messages traveling
312 between the switch and its controller on the primary OpenFlow
313 connection. This can be useful for debugging switch and controller
317 \fB--in-band\fR, \fB--out-of-band\fR
318 Configures \fBovs\-openflowd\fR to operate in in-band or out-of-band control
319 mode (see \fBContacting the Controller\fR above). When neither option
320 is given, the default is in-band control.
323 \fB--netflow=\fIip\fB:\fIport\fR
324 Configures the given UDP \fIport\fR on the specified IP \fIip\fR as
325 a recipient of NetFlow messages for expired flows. The \fIip\fR must
326 be specified numerically, not as a DNS name.
328 This option may be specified multiple times to configure additional
331 .SS "Rate-Limiting Options"
333 These options configure how the switch applies a ``token bucket'' to
334 limit the rate at which packets in unknown flows are forwarded to an
335 OpenFlow controller for flow-setup processing. This feature prevents
336 a single OpenFlow switch from overwhelming a controller.
339 \fB--rate-limit\fR[\fB=\fIrate\fR]
341 Limits the maximum rate at which packets will be forwarded to the
342 OpenFlow controller to \fIrate\fR packets per second. If \fIrate\fR
343 is not specified then the default of 1,000 packets per second is used.
345 If \fB--rate-limit\fR is not used, then the switch does not limit the
346 rate at which packets are forwarded to the controller.
349 \fB--burst-limit=\fIburst\fR
351 Sets the maximum number of unused packet credits that the switch will
352 allow to accumulate during time in which no packets are being
353 forwarded to the OpenFlow controller to \fIburst\fR (measured in
354 packets). The default \fIburst\fR is one-quarter of the \fIrate\fR
355 specified on \fB--rate-limit\fR.
357 This option takes effect only when \fB--rate-limit\fR is also specified.
359 .SS "Datapath Options"
361 .IP "\fB\-\-ports=\fIport\fR[\fB,\fIport\fR...]"
362 Ordinarily, \fBovs\-openflowd\fR expects the administrator to create
363 the specified \fIdatapath\fR and add ports to it externally with a
364 utility such as \fBovs\-dpctl\fR. However, the userspace switch
365 datapath is implemented inside \fBovs\-openflowd\fR itself and does
366 not (currently) have any external interface for \fBovs\-dpctl\fR to
367 access. As a stopgap measure, this option specifies one or more ports
368 to add to the datapath at \fBovs\-openflowd\fR startup time. Multiple
369 ports may be specified as a comma-separated list or by specifying
370 \fB\-\-ports\fR multiple times.
372 See \fBINSTALL.userspace\fR for more information about userspace
379 .so lib/ssl-bootstrap.man
381 .SS "Logging Options"
385 .so lib/leak-checker.man
390 .BR ovs\-controller (8),
391 .BR ovs\-discover (8),
395 .BR ovs\-vswitchd.conf (5)