secchan: Tighten in-band traffic always allowed into switch

[openvswitch] / vswitchd / ovs-vswitchd.conf.5.in

diff --git a/vswitchd/ovs-vswitchd.conf.5.in b/vswitchd/ovs-vswitchd.conf.5.in
index 898721845c9810894d089b88266ae762a17b9efc..d613419fc4907a7297c85f116e4c4db298e6d153 100644 (file)
--- a/vswitchd/ovs-vswitchd.conf.5.in
+++ b/vswitchd/ovs-vswitchd.conf.5.in
@@ -72,11 +72,23 @@ in the bridge, by specifying it as one of the values for key
 included, then its MAC address is by default the lowest-numbered MAC
 address among the other bridge ports, ignoring other internal ports
 and bridge ports that are
 included, then its MAC address is by default the lowest-numbered MAC
 address among the other bridge ports, ignoring other internal ports
 and bridge ports that are

-used as port mirroring destinations (see \fBPort Mirroring\fR, below).  To
-use a specific MAC address instead, set \fBbridge.\fIname\fB.mac\fR to
-a MAC address in the format
+used as port mirroring destinations (see \fBPort Mirroring\fR, below).
+For this purpose, the MAC of a bonded port (see \fBNetwork Device
+Bonding\fR, below) is by default the MAC of its slave whose name is first in
+alphabetical order.
+There are two ways to modify this algorithm for selecting the MAC
+address of the local port:
+.IP \(bu
+To use a specific MAC address for the local port, set
+\fBbridge.\fIname\fB.mac\fR to a MAC address in the format

 \fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR, where each
 \fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fB:\fIxx\fR, where each

-\fIx\fR is a hex digit.  If no valid MAC address can be determined
+\fIx\fR is a hex digit.
+.IP \(bu
+To override the MAC of a port for the purpose of this algorithm, set
+\fBport.\fIport\fB.mac\fR to a MAC address in the format described
+above.
+.PP
+If no valid MAC address can be determined

 either of these ways, then a MAC address is randomly generated.
 .PP
 The following syntax defines a bridge named \fBmybr\fR, configured
 either of these ways, then a MAC address is randomly generated.
 .PP
 The following syntax defines a bridge named \fBmybr\fR, configured


@@ -167,6 +179,10 @@ enabling or disabling an interface, set the value of
 \fBbonding.\fIname\fB.updelay\fR or
 \fBbonding.\fIname\fB.downdelay\fR, respectively, to a positive
 integer, interpreted in milliseconds.
 \fBbonding.\fIname\fB.updelay\fR or
 \fBbonding.\fIname\fB.downdelay\fR, respectively, to a positive
 integer, interpreted in milliseconds.

+The \fBupdelay\fR setting is honored only when at least one bonded
+interface is already enabled.  When no interfaces are enabled, then
+the first bond interface to come up is enabled immediately.  The
+\fBdowndelay\fR setting is always honored.

 .PP
 The following syntax bonds \fBeth0\fR and \fBeth1\fR into a bonding
 device named \fBbond0\fR, which is added to bridge \fBmybr\fR along
 .PP
 The following syntax bonds \fBeth0\fR and \fBeth1\fR into a bonding
 device named \fBbond0\fR, which is added to bridge \fBmybr\fR along


@@ -275,11 +291,17 @@ dropped.  Shaping uses queues to delay packets so that egress traffic
 leaves at the specified rate.
 
 .ST "Ingress Policing"
 leaves at the specified rate.
 
 .ST "Ingress Policing"

-The rate at which traffic is allowed to enter through a particular
-physical port can be configured with ingress policing.  The rate is 
-specified in kilobits (1000 bits) per second with a maximum burst size 
-specified in kilobits (1000 bits).  The burst size should be at least
-the size of the port's MTU. 
+The rate at which traffic is allowed to enter through a port may be 
+configured with ingress policing.  Note that "ingress" is from the 
+perspective of \fBovs\-vswitchd\fR.  If configured on a physical port, 
+then it limits the rate at which traffic is allowed into the system from 
+the outside.  If configured on a virtual interface that is connected to 
+a virtual machine, then it limits the rate at which the guest is able to 
+transmit.
+
+The rate is specified in kilobits (1000 bits) per second with a maximum 
+burst size specified in kilobits (1000 bits).  The burst size should be at 
+least the size of the interface's MTU.  

 
 A port may be configured to enforce ingress policing by defining the
 key \fBport.\fIname\fB.ingress.policing-rate\fR with an integer
 
 A port may be configured to enforce ingress policing by defining the
 key \fBport.\fIname\fB.ingress.policing-rate\fR with an integer


@@ -308,8 +330,9 @@ NetFlow is a protocol that exports a number of details about terminating
 IP flows, such as the principals involved and duration.  A bridge may be 
 configured to send NetFlow v5 records to NetFlow collectors when flows 
 end.  To enable, define the key \fBnetflow.\fIbridge\fB.host\fR for each 
 IP flows, such as the principals involved and duration.  A bridge may be 
 configured to send NetFlow v5 records to NetFlow collectors when flows 
 end.  To enable, define the key \fBnetflow.\fIbridge\fB.host\fR for each 

-collector in the form \fIhost\fB:\fIport\fR.  Records from \fIbridge\fR 
-will be sent to each \fIhost\fR on UDP \fIport\fR.
+collector in the form \fIip\fB:\fIport\fR.  Records from \fIbridge\fR 
+will be sent to each \fIip\fR on UDP \fIport\fR.  The \fIip\fR must
+be specified numerically, not as a DNS name.

 
 The NetFlow messages will use the datapath index for the engine type and id.  
 This can be overridden with the \fBnetflow.\fIbridge\fB.engine-type\fR and 
 
 The NetFlow messages will use the datapath index for the engine type and id.  
 This can be overridden with the \fBnetflow.\fIbridge\fB.engine-type\fR and 


@@ -341,20 +364,19 @@ supports the OpenFlow Management Protocol, such as NOX.  This
 functionality is enabled by setting the key \fBmgmt.controller\fR to one 
 of the following values:
 .
 functionality is enabled by setting the key \fBmgmt.controller\fR to one 
 of the following values:
 .

-.TP
-\fBssl:\fIhost\fR[\fB:\fIport\fR]
-The specified SSL \fIport\fR (default: 6633) on the given remote
-\fIhost\fR.  SSL must be configured when this form is used (see \fBSSL
+.IP "\fBssl:\fIip\fR[\fB:\fIport\fR]"
+The specified SSL \fIport\fR (default: 6633) on the host at the given
+\fIip\fR, which must be expressed as an IP address (not a DNS name).
+SSL must be configured when this form is used (see \fBSSL

 Configuration\fR, below).
 .
 Configuration\fR, below).
 .

-.TP
-\fBtcp:\fIhost\fR[\fB:\fIport\fR]
-The specified TCP \fIport\fR (default: 6633) on the given remote
-\fIhost\fR.
+.IP "\fBtcp:\fIip\fR[\fB:\fIport\fR]"
+The specified TCP \fIport\fR (default: 6633) on the host at the given
+\fIip\fR, which must be expressed as an IP address (not a DNS name).

 .PP
 The maximum time between attempts to connect to the controller may be
 specified in integral seconds with the \fBmgmt.max-backoff\fR key.  The
 .PP
 The maximum time between attempts to connect to the controller may be
 specified in integral seconds with the \fBmgmt.max-backoff\fR key.  The

-default maximum backoff is 15 seconds, and the minimum value is 1
+default maximum backoff is 8 seconds, and the minimum value is 1

 second.
 
 An inactivity probe may be configured with the \fBmgmt.inactivity-probe\fR
 second.
 
 An inactivity probe may be configured with the \fBmgmt.inactivity-probe\fR


@@ -362,7 +384,7 @@ key.  If \fBovs\-vswitchd\fR does not communicate with the controller for the
 specified number of seconds, it will send a probe.  If a response is not
 received for an additional amount of that time, \fBovs\-vswitchd\fR assumes
 the connection has been broken and attempts to reconnect.  The default
 specified number of seconds, it will send a probe.  If a response is not
 received for an additional amount of that time, \fBovs\-vswitchd\fR assumes
 the connection has been broken and attempts to reconnect.  The default

-is 15 seconds, and the minimum value is 5 seconds.
+and minimum values are both 5 seconds.

 
 A management id may be specified with the \fBmgmt.id\fR key.  It takes
 an id in the form of exactly 12 hexadecimal digits.  If one is not
 
 A management id may be specified with the \fBmgmt.id\fR key.  It takes
 an id in the form of exactly 12 hexadecimal digits.  If one is not


@@ -421,15 +443,16 @@ that it receives specifies one or more DNS servers.
 .RE
 .
 .TP
 .RE
 .
 .TP

-\fBssl:\fIhost\fR[\fB:\fIport\fR]
-The specified SSL \fIport\fR (default: 6633) on the given remote
-\fIhost\fR.  SSL must be configured when this form is used (see \fBSSL
+\fBssl:\fIip\fR[\fB:\fIport\fR]
+The specified SSL \fIport\fR (default: 6633) on the host at the given
+\fIip\fR, which must be expressed as an IP address (not a DNS name).
+SSL must be configured when this form is used (see \fBSSL

 Configuration\fR, below).
 .
 .TP
 Configuration\fR, below).
 .
 .TP

-\fBtcp:\fIhost\fR[\fB:\fIport\fR]
-The specified TCP \fIport\fR (default: 6633) on the given remote
-\fIhost\fR.
+\fBtcp:\fIip\fR[\fB:\fIport\fR]
+The specified TCP \fIport\fR (default: 6633) on the host at the given
+\fIip\fR, which must be expressed as an IP address (not a DNS name).

 .
 .TP
 \fBunix:\fIfile\fR
 .
 .TP
 \fBunix:\fIfile\fR