A database with this schema holds the configuration for one Open
- vSwitch daemon. The root of the configuration for the daemon is
- the table, which must have exactly one
+
+ A database with this schema holds the configuration for one Open
+ vSwitch daemon. The top-level configuration for the daemon is the
+ table, which must have exactly one
record. Records in other tables are significant only when they
- can be reached directly or indirectly from the
- table.
+ can be reached directly or indirectly from the table. Records that are not reachable from
+ the table are automatically deleted
+ from the database, except for records in a few distinguished
+ ``root set'' tables noted below.
+
- Configuration for an Open vSwitch daemon. There must be exactly one record
- in the table.
+ Configuration for an Open vSwitch daemon. There must be exactly
+ one record in the table.
Set of bridges managed by the daemon.
-
- Default used by bridges. May be
- overridden on a per-bridge basis by the column in .
-
-
-
- Remote database clients to which the Open vSwitch's database server
- should connect or to which it should listen.
-
-
SSL used globally by the daemon.
+
+ Key-value pairs for configuring rarely used Open vSwitch features. The
+ currently defined key-value pairs are:
+
+
enable-statistics
+
+ Set to true to enable populating the column or false (the default)
+ disable populating it.
+
+
+
+
- Key-value pairs that identify this Open vSwitch's role in
- external systems. The currently defined key-value pairs are:
+ Key-value pairs for use by external frameworks that integrate
+ with Open vSwitch, rather than by Open vSwitch itself. System
+ integrators should either use the Open vSwitch development
+ mailing list to coordinate on common key-value definitions, or
+ choose key names that are likely to be unique. The currently
+ defined common key-value pairs are:
-
system-uuid
-
A universally unique identifier for the Open vSwitch's
- physical host. The form of the identifier depends on the
- type of the host. On a Citrix XenServer, this is the host
- UUID displayed by, e.g., xe host-list.
+
system-id
+
A unique identifier for the Open vSwitch's physical host.
+ The form of the identifier depends on the type of the host.
+ On a Citrix XenServer, this will likely be the same as
+ .
+
xs-system-uuid
+
The Citrix XenServer universally unique identifier for the
+ physical host as displayed by xe host-list.
@@ -56,6 +71,231 @@
after it finishes applying a set of
configuration changes.
+
+
+ Describes functionality supported by the hardware and software platform
+ on which this Open vSwitch is based. Clients should not modify this
+ column. See the description for defined
+ capability categories and the meaning of associated
+ records.
+
+
+
+
+ Key-value pairs that report statistics about a system running an Open
+ vSwitch. These are updated periodically (currently, every 5
+ seconds). Key-value pairs that cannot be determined or that do not
+ apply to a platform are omitted.
+
+
+
+ Statistics are disabled unless is set to true.
+
+
+
+
cpu
+
+
+ Number of CPU processors, threads, or cores currently online and
+ available to the operating system on which Open vSwitch is
+ running, as an integer. This may be less than the number
+ installed, if some are not online or if they are not available to
+ the operating system.
+
+
+ Open vSwitch userspace processes are not multithreaded, but the
+ Linux kernel-based datapath is.
+
+
+
+
load_average
+
+
+ A comma-separated list of three floating-point numbers,
+ representing the system load average over the last 1, 5, and 15
+ minutes, respectively.
+
+
+
+
memory
+
+
+ A comma-separated list of integers, each of which represents a
+ quantity of memory in kilobytes that describes the operating
+ system on which Open vSwitch is running. In respective order,
+ these values are:
+
+
+
+
Total amount of RAM allocated to the OS.
+
RAM allocated to the OS that is in use.
+
RAM that can be flushed out to disk or otherwise discarded
+ if that space is needed for another purpose. This number is
+ necessarily less than or equal to the previous value.
+
Total disk space allocated for swap.
+
Swap space currently in use.
+
+
+
+ On Linux, all five values can be determined and are included. On
+ other operating systems, only the first two values can be
+ determined, so the list will only have two values.
+
+
+
+
process_name
+
+
+ One such key-value pair will exist for each running Open vSwitch
+ daemon process, with name replaced by the daemon's
+ name (e.g. process_ovs-vswitchd). The value is a
+ comma-separated list of integers. The integers represent the
+ following, with memory measured in kilobytes and durations in
+ milliseconds:
+
+
+
+
The process's virtual memory size.
+
The process's resident set size.
+
The amount of user and system CPU time consumed by the
+ process.
+
The number of times that the process has crashed and been
+ automatically restarted by the monitor.
+
The duration since the process was started.
+
The duration for which the process has been running.
+
+
+
+ The interpretation of some of these values depends on whether the
+ process was started with the . If it
+ was not, then the crash count will always be 0 and the two
+ durations will always be the same. If
+ was given, then the crash count may be positive; if it is, the
+ latter duration is the amount of time since the most recent crash
+ and restart.
+
+
+
+ There will be one key-value pair for each file in Open vSwitch's
+ ``run directory'' (usually /var/run/openvswitch)
+ whose name ends in .pid, whose contents are a
+ process ID, and which is locked by a running process. The
+ name is taken from the pidfile's name.
+
+
+
+ Currently Open vSwitch is only able to obtain all of the above
+ detail on Linux systems. On other systems, the same key-value
+ pairs will be present but the values will always be the empty
+ string.
+
+
+
+
file_systems
+
+
+ A space-separated list of information on local, writable file
+ systems. Each item in the list describes one file system and
+ consists in turn of a comma-separated list of the following:
+
+
+
+
Mount point, e.g. / or /var/log.
+ Any spaces or commas in the mount point are replaced by
+ underscores.
+
Total size, in kilobytes, as an integer.
+
Amount of storage in use, in kilobytes, as an integer.
+
+
+
+ This key-value pair is omitted if there are no local, writable
+ file systems or if Open vSwitch cannot obtain the needed
+ information.
+
+
+
+
+
+
+
+
+ These columns report the types and versions of the hardware and
+ software running Open vSwitch. We recommend in general that software
+ should test whether specific features are supported instead of relying
+ on version number checks. These values are primarily intended for
+ reporting to human administrators.
+
+
+
+ The Open vSwitch version number, e.g. 1.1.0.
+ If Open vSwitch was configured with a build number, then it is
+ also included, e.g. 1.1.0+build6579.
+
+
+
+
+ The database schema version number in the form
+ major.minor.tweak,
+ e.g. 1.2.3. Whenever the database schema is changed in
+ a non-backward compatible way (e.g. deleting a column or a table),
+ major is incremented. When the database schema is changed
+ in a backward compatible way (e.g. adding a new column),
+ minor is incremented. When the database schema is changed
+ cosmetically (e.g. reindenting its syntax), tweak is
+ incremented.
+
+
+
+ The schema version is part of the database schema, so it can also be
+ retrieved by fetching the schema using the Open vSwitch database
+ protocol.
+
+
+
+
+
+ An identifier for the type of system on top of which Open vSwitch
+ runs, e.g. XenServer or KVM.
+
+
+ System integrators are responsible for choosing and setting an
+ appropriate value for this column.
+
+
+
+
+
+ The version of the system identified by ,
+ e.g. 5.6.100-39265p on XenServer 5.6.100 build 39265.
+
+
+ System integrators are responsible for choosing and setting an
+ appropriate value for this column.
+
+
+
+
+
+
+
+ These columns primarily configure the Open vSwitch database
+ (ovsdb-server), not the Open vSwitch switch
+ (ovs-vswitchd). The OVSDB database also uses the settings.
+
+
+
+ The Open vSwitch switch does read the database configuration to
+ determine remote IP addresses to which in-band control should apply.
+
+
+
+ Database clients to which the Open vSwitch database server should
+ connect or to which it should listen, along with options for how these
+ connection should be configured. See the table
+ for more information.
+
@@ -94,24 +334,64 @@
- VLAN IDs of VLANs on which MAC address learning should be disabled, so
- that packets are flooded instead of being sent to specific ports that
- are believed to contain packets' destination MACs. This should
- ordinarily be used to disable MAC learning on VLANs used for mirroring
- (RSPAN VLANs). It may also be useful for debugging.
+
+ VLAN IDs of VLANs on which MAC address learning should be disabled,
+ so that packets are flooded instead of being sent to specific ports
+ that are believed to contain packets' destination MACs. This should
+ ordinarily be used to disable MAC learning on VLANs used for
+ mirroring (RSPAN VLANs). It may also be useful for debugging.
+
+
+ SLB bonding (see the column in
+ the table) is incompatible with
+ flood_vlans. Consider using another bonding mode or
+ a different type of mirror instead.
+
- OpenFlow controller. If unset, defaults to that specified by
- in the
- table. If the default is also unset, then
- no OpenFlow controller will be used.
+ OpenFlow controller set. If unset, then no OpenFlow controllers
+ will be used.
+
+
+
+
When a controller is configured, it is, ordinarily, responsible
+ for setting up all flows on the switch. Thus, if the connection to
+ the controller fails, no new network connections can be set up.
+ If the connection to the controller stays down long enough,
+ no packets can pass through the switch at all. This setting
+ determines the switch's response to such a situation. It may be set
+ to one of the following:
+
+
standalone
+
If no message is received from the controller for three
+ times the inactivity probe interval
+ (see ), then Open vSwitch
+ will take over responsibility for setting up flows. In
+ this mode, Open vSwitch causes the bridge to act like an
+ ordinary MAC-learning switch. Open vSwitch will continue
+ to retry connecting to the controller in the background
+ and, when the connection succeeds, it will discontinue its
+ standalone behavior.
+
secure
+
Open vSwitch will not set up flows on its own when the
+ controller connection fails or when no controllers are
+ defined. The bridge will continue to retry connecting to
+ any defined controllers forever.
+
+
+
If this value is unset, the default is implementation-specific.
+
When more than one controller is configured,
+ is considered only when none of the
+ configured controllers can be contacted.
Reports the OpenFlow datapath ID in use. Exactly 16 hex digits.
+ (Setting this column has no useful effect. Set instead.)
@@ -123,15 +403,22 @@
- Key-value pairs that identify this bridge's role in external systems.
- The currently defined key-value pairs are:
+ Key-value pairs for use by external frameworks that integrate
+ with Open vSwitch, rather than by Open vSwitch itself. System
+ integrators should either use the Open vSwitch development
+ mailing list to coordinate on common key-value definitions, or
+ choose key names that are likely to be unique. The currently
+ defined key-value pairs are:
+
bridge-id
+
A unique identifier of the bridge. On Citrix XenServer this will
+ commonly be the same as
+ .
xs-network-uuids
-
Space-delimited set of the Citrix XenServer network UUIDs with
- which this bridge is associated.
-
xs-network-names
-
Semicolon-delimited set of Citrix XenServer network names with
- which this bridge is associated.
+
Semicolon-delimited set of universally unique identifier(s) for
+ the network with which this bridge is associated on a Citrix
+ XenServer host. The network identifiers are RFC 4122 UUIDs as
+ displayed by, e.g., xe network-list.
@@ -142,12 +429,48 @@
datapath-id
Exactly 16 hex
digits to set the OpenFlow datapath ID to a specific
- value.
+ value. May not be all-zero.
+
disable-in-band
+
If set to true, disable in-band control on
+ the bridge regardless of controller and manager settings.
hwaddr
An Ethernet address in the form
xx:xx:xx:xx:xx:xx
to set the hardware address of the local port and influence the
datapath ID.
+
in-band-queue
+
+ A queue ID as a nonnegative integer. This sets the OpenFlow queue
+ ID that will be used by flows set up by in-band control on this
+ bridge. If unset, or if the port used by an in-band control flow
+ does not have QoS configured, or if the port does not have a queue
+ with the specified ID, the default queue is used instead.
+
+
flow-eviction-threshold
+
+ A number of flows as a nonnegative integer. This sets number
+ of flows at which eviction from the kernel flow table will
+ be triggered.
+ If there are a large number of flows then increasing this
+ value to around the number of flows present
+ can result in reduced CPU usage and packet loss.
+
+
+ The default is 1000.
+
+
+ Values below 100 will be rounded up to 100.
+
+
forward-bpdu
+
+ Option to allow forwarding of BPDU frames when NORMAL
+ action if invoked. Frames with reserved Ethernet addresses
+ (e.g. STP BPDU) will be forwarded when this option is enabled.
+ If the Open vSwitch bridge is used to connect different
+ Ethernet networks, and if Open vSwtich node does not run STP,
+ then this option should be enabled.
+ Default is disabled, set to true to enable.
+
@@ -179,53 +502,111 @@
A bridge port must be configured for VLANs in one of two
mutually exclusive ways:
-
A ``trunk port'' has an empty value for
- and a possibly non-empty
- value.
+
A ``trunk port'' has an empty value for . Its value may be
+ empty or non-empty.
An ``implicitly tagged VLAN port'' or ``access port''
- has an nonempty value for and an empty
- value.
+ has an nonempty value for . Its
+ value must be empty.
If and are both
nonempty, the configuration is ill-formed.
-
If nonempty, this port's implicitly tagged VLAN. Frames
- arriving on trunk ports will be forwarded to this port only
- if they are tagged with the given VLAN. Frames arriving on
- other VLAN ports will be forwarded to this port only if they
- have the same value. Frames forwarded
- to this port will not have an 802.1Q header.
-
When a frame with a 802.1Q header that indicates a nonzero VLAN is
- received on an implicit VLAN port, it is discarded.
-
Must be empty if this is a trunk port.
+
+ If this is an access port (see above), the port's implicitly
+ tagged VLAN. Must be empty if this is a trunk port.
+
+
+ Frames arriving on trunk ports will be forwarded to this
+ port only if they are tagged with the given VLAN (or, if
+ is 0, then if they lack a VLAN header).
+ Frames arriving on other access ports will be forwarded to
+ this port only if they have the same
+ value. Frames forwarded to this port will not have an
+ 802.1Q header.
+
+
+ When a frame with a 802.1Q header that indicates a nonzero
+ VLAN is received on an access port, it is discarded.
+
-
The 802.1Q VLAN(s) that this port trunks. If the column is
- empty, then the port trunks all VLANs as well as packets that
- have no VLAN header. Otherwise, only frames that have an
- 802.1Q header with one of the specified VLANs are accepted.
- If 0 is included, then frames without an 802.1Q
- header are also accepted.
-
Must be empty unless this is a trunk port.
+
+ If this is a trunk port (see above), the 802.1Q VLAN(s) that
+ this port trunks; if it is empty, then the port trunks all
+ VLANs. Must be empty if this is an access port.
+
+
+ Frames arriving on trunk ports are dropped if they are not
+ in one of the specified VLANs. For this purpose, packets
+ that have no VLAN header are treated as part of VLAN 0.
+
-
A port that has more than one interface is a ``bonded port.''
- Bonding allows for load balancing and fail-over. Open vSwitch
- supports ``source load balancing'' (SLB) bonding, which
- assigns flows to slaves based on source MAC address, with
- periodic rebalancing as traffic patterns change. This form of
- bonding does not require 802.3ad or other special support from
- the upstream switch to which the slave devices are
- connected.
+
A port that has more than one interface is a ``bonded port.'' Bonding
+ allows for load balancing and fail-over. Some kinds of bonding will
+ work with any kind of upstream switch:
+
+
+
balance-slb
+
+ Balances flows among slaves based on source MAC address and output
+ VLAN, with periodic rebalancing as traffic patterns change.
+
+
+
active-backup
+
+ Assigns all flows to one slave, failing over to a backup slave when
+ the active slave is disabled.
+
+
+
+
+ The following modes require the upstream switch to support 802.3ad with
+ successful LACP negotiation. If LACP negotiation fails then
+ balance-slb style flow hashing is used as a fallback:
+
+
+
+
balance-tcp
+
+ Balances flows among slaves based on L2, L3, and L4 protocol
+ information such as destination MAC address, IP address, and TCP
+ port.
+
+
+
+
+
stable
+
+
Attempts to always assign a given flow to the same slave
+ consistently. In an effort to maintain stability, no load
+ balancing is done. Uses a similar hashing strategy to
+ balance-tcp, always taking into account L3 and L4
+ fields even if LACP negotiations are unsuccessful.
+
Slave selection decisions are made based on if set. Otherwise,
+ OpenFlow port number is used. Decisions are consistent across all
+ ovs-vswitchd instances with equivalent
+
+ values.
+
+
These columns apply only to bonded ports. Their values are
otherwise ignored.
+
+
The type of bonding used for a bonded port. Defaults to
+ balance-slb if unset.
+
+
+
For a bonded port, the number of milliseconds for which carrier must
stay up on an interface before the interface is considered to be up.
@@ -246,9 +627,25 @@
name of the port. Use only for compatibility with legacy software that
requires this.
+
+
+
Configures LACP on this port. LACP allows directly connected
+ switches to negotiate which links may be bonded. LACP may be enabled
+ on non-bonded ports for the benefit of any switches they may be
+ connected to. active ports are allowed to initiate LACP
+ negotiations. passive ports are allowed to participate
+ in LACP negotiations initiated by a remote switch, but not allowed to
+ initiate such negotiations themselves. If unset Open vSwitch will
+ choose a reasonable default.
+
+
+
+ Quality of Service configuration for this port.
+
+
The MAC address to use for this port for the purpose of choosing the
bridge's MAC address. This column does not necessarily reflect the
@@ -262,22 +659,79 @@
- Key-value pairs that identify this port's role in external systems. No
- key-value pairs native to are currently defined.
- For fake bridges (see the column), external
- IDs for the fake bridge are defined here by prefixing a
- key
- with fake-bridge-,
- e.g. fake-bridge-xs-network-uuids.
+
+ Key-value pairs for use by external frameworks that integrate with
+ Open vSwitch, rather than by Open vSwitch itself. System integrators
+ should either use the Open vSwitch development mailing list to
+ coordinate on common key-value definitions, or choose key names that
+ are likely to be unique.
+
+
+ No key-value pairs native to are currently
+ defined. For fake bridges (see the
+ column), external IDs for the fake bridge are defined here by
+ prefixing a key with fake-bridge-,
+ e.g. fake-bridge-xs-network-uuids.
+
Key-value pairs for configuring rarely used port features. The
currently defined key-value pairs are:
-
hwaddr
-
An Ethernet address in the form
- xx:xx:xx:xx:xx:xx.
+
bond-rebalance-interval
+
For an SLB bonded port, the number of milliseconds between
+ successive attempts to rebalance the bond, that is, to
+ move source MACs and their flows from one interface on
+ the bond to another in an attempt to keep usage of each
+ interface roughly equal. The default is 10000 (10
+ seconds), and the minimum is 1000 (1 second).
+
bond-detect-mode
+
Sets the method used to detect link failures in a bonded port.
+ Options are carrier and miimon. Defaults
+ to carrier which uses each interface's carrier to detect
+ failures. When set to miimon, will check for failures
+ by polling each interface's MII.
+
bond-miimon-interval
+
The number of milliseconds between successive attempts to
+ poll each interface's MII. Only relevant on ports which use
+ miimon to detect failures.
+
bond-hash-basis
+
An integer hashed along with flows when choosing output slaves.
+ When changed, all flows will be assigned different hash values
+ possibly causing slave selection decisions to change.
+
lacp-system-id
+
The LACP system ID of this . The system ID
+ of a LACP bond is used to identify itself to its partners. Must
+ be a nonzero MAC address.
+
lacp-system-priority
+
The LACP system priority of this . In
+ LACP negotiations, link status decisions are made by the system
+ with the numerically lower priority. Must be a number between 1
+ and 65535.
+
lacp-time
+
+
The LACP timing which should be used on this
+ . Possible values are fast,
+ slow and a positive number of milliseconds. By
+ default slow is used. When configured to be
+ fast LACP heartbeats are requested at a rate of once
+ per second causing connectivity problems to be detected more
+ quickly. In slow mode, heartbeats are requested at
+ a rate of once every 30 seconds.
+
+
Users may manually set a heartbeat transmission rate to increase
+ the fault detection speed further. When manually set, OVS
+ expects the partner switch to be configured with the same
+ transmission rate. Manually setting lacp-time to
+ something other than fast or slow is
+ not supported by the LACP specification.
+
+
lacp-heartbeat
+
Treats LACP like a simple heartbeat protocol for link state
+ monitoring. Most features of the LACP protocol are disabled when
+ this mode is in use.
@@ -322,7 +776,7 @@
Open vSwitch populates this column when the port number becomes
known. If the interface is successfully added,
will be set to a number between 1 and 65535
- (generally either in the range 1 to 65280, exclusive, or 65534, the
+ (generally either in the range 1 to 65279, inclusive, or 65534, the
port number for the OpenFlow ``local port''). If the interface
cannot be added then Open vSwitch sets this column
to -1.
@@ -349,7 +803,346 @@
tap
A TUN/TAP device managed by Open vSwitch.
gre
-
A GRE tunnel device managed by Open vSwitch.
+
An Ethernet over RFC 2890 Generic Routing Encapsulation over IPv4
+ tunnel. Each tunnel must be uniquely identified by the
+ combination of ,
+ , and
+ . Note that if two ports
+ are defined that are the same except one has an optional
+ identifier and the other does not, the more specific one is
+ matched first. is considered
+ more specific than if a port
+ defines one and another port defines the other. The following
+ options may be specified in the column:
+
+
remote_ip
+
Required. The tunnel endpoint.
+
+
+
local_ip
+
Optional. The destination IP that received packets must
+ match. Default is to match all addresses.
+
+
+
in_key
+
Optional. The GRE key that received packets must contain.
+ It may either be a 32-bit number (no key and a key of 0 are
+ treated as equivalent) or the word flow. If
+ flow is specified then any key will be accepted
+ and the key will be placed in the tun_id field
+ for matching in the flow table. The ovs-ofctl manual page
+ contains additional information about matching fields in
+ OpenFlow flows. Default is no key.
+
+
+
out_key
+
Optional. The GRE key to be set on outgoing packets. It may
+ either be a 32-bit number or the word flow. If
+ flow is specified then the key may be set using
+ the set_tunnel Nicira OpenFlow vendor extension (0
+ is used in the absence of an action). The ovs-ofctl manual
+ page contains additional information about the Nicira OpenFlow
+ vendor extensions. Default is no key.
+
+
+
key
+
Optional. Shorthand to set in_key and
+ out_key at the same time.
+
+
+
tos
+
Optional. The value of the ToS bits to be set on the
+ encapsulating packet. It may also be the word
+ inherit, in which case the ToS will be copied from
+ the inner packet if it is IPv4 or IPv6 (otherwise it will be
+ 0). Note that the ECN fields are always inherited. Default is
+ 0.
+
+
+
ttl
+
Optional. The TTL to be set on the encapsulating packet.
+ It may also be the word inherit, in which case the
+ TTL will be copied from the inner packet if it is IPv4 or IPv6
+ (otherwise it will be the system default, typically 64).
+ Default is the system default TTL.
+
+
+
csum
+
Optional. Compute GRE checksums on outgoing packets.
+ Checksums present on incoming packets will be validated
+ regardless of this setting. Note that GRE checksums
+ impose a significant performance penalty as they cover the
+ entire packet. As the contents of the packet is typically
+ covered by L3 and L4 checksums, this additional checksum only
+ adds value for the GRE and encapsulated Ethernet headers.
+ Default is disabled, set to true to enable.
+
+
+
df_inherit
+
Optional. If enabled, the Don't Fragment bit will be copied
+ from the inner IP headers (those of the encapsulated traffic)
+ to the outer (tunnel) headers. Default is disabled; set to
+ true to enable.
+
+
+
df_default
+
Optional. If enabled, the Don't Fragment bit will be set by
+ default on tunnel headers if the df_inherit option
+ is not set, or if the encapsulated packet is not IP. Default
+ is enabled; set to false to disable.
+
+
+
pmtud
+
Optional. Enable tunnel path MTU discovery. If enabled
+ ``ICMP Destination Unreachable - Fragmentation Needed''
+ messages will be generated for IPv4 packets with the DF bit set
+ and IPv6 packets above the minimum MTU if the packet size
+ exceeds the path MTU minus the size of the tunnel headers.
+ Note that this option causes behavior that is typically
+ reserved for routers and therefore is not entirely in
+ compliance with the IEEE 802.1D specification for bridges.
+ Default is enabled; set to false to disable.
+
+
+
header_cache
+
Optional. Enable caching of tunnel headers and the output
+ path. This can lead to a significant performance increase
+ without changing behavior. In general it should not be
+ necessary to adjust this setting. However, the caching can
+ bypass certain components of the IP stack (such as IP tables)
+ and it may be useful to disable it if these features are
+ required or as a debugging measure. Default is enabled, set to
+ false to disable.
+
+
+
ipsec_gre
+
An Ethernet over RFC 2890 Generic Routing Encapsulation
+ over IPv4 IPsec tunnel. Each tunnel (including those of type
+ gre) must be uniquely identified by the
+ combination of and
+ . Note that if two ports are
+ defined that are the same except one has an optional identifier and
+ the other does not, the more specific one is matched first.
+ An authentication method of
+ or must be defined. The
+ following options may be specified in the
+ column:
+
+
remote_ip
+
Required. The tunnel endpoint.
+
+
+
local_ip
+
Optional. The destination IP that received packets must
+ match. Default is to match all addresses.
+
+
+
peer_cert
+
Required for certificate authentication. A string
+ containing the peer's certificate in PEM format.
+ Additionally the host's certificate must be specified
+ with the certificate option.
+
+
+
certificate
+
Required for certificate authentication. The name of a
+ PEM file containing a certificate that will be presented
+ to the peer during authentication.
+
+
+
private_key
+
Optional for certificate authentication. The name of
+ a PEM file containing the private key associated with
+ certificate. If certificate
+ contains the private key, this option may be omitted.
+
+
+
psk
+
Required for pre-shared key authentication. Specifies a
+ pre-shared key for authentication that must be identical on
+ both sides of the tunnel.
+
+
+
in_key
+
Optional. The GRE key that received packets must contain.
+ It may either be a 32-bit number (no key and a key of 0 are
+ treated as equivalent) or the word flow. If
+ flow is specified then any key will be accepted
+ and the key will be placed in the tun_id field
+ for matching in the flow table. The ovs-ofctl manual page
+ contains additional information about matching fields in
+ OpenFlow flows. Default is no key.
+
+
+
out_key
+
Optional. The GRE key to be set on outgoing packets. It may
+ either be a 32-bit number or the word flow. If
+ flow is specified then the key may be set using
+ the set_tunnel Nicira OpenFlow vendor extension (0
+ is used in the absence of an action). The ovs-ofctl manual
+ page contains additional information about the Nicira OpenFlow
+ vendor extensions. Default is no key.
+
+
+
key
+
Optional. Shorthand to set in_key and
+ out_key at the same time.
+
+
+
tos
+
Optional. The value of the ToS bits to be set on the
+ encapsulating packet. It may also be the word
+ inherit, in which case the ToS will be copied from
+ the inner packet if it is IPv4 or IPv6 (otherwise it will be
+ 0). Note that the ECN fields are always inherited. Default is
+ 0.
+
+
+
ttl
+
Optional. The TTL to be set on the encapsulating packet.
+ It may also be the word inherit, in which case the
+ TTL will be copied from the inner packet if it is IPv4 or IPv6
+ (otherwise it will be the system default, typically 64).
+ Default is the system default TTL.
+
+
+
csum
+
Optional. Compute GRE checksums on outgoing packets.
+ Checksums present on incoming packets will be validated
+ regardless of this setting. Note that GRE checksums
+ impose a significant performance penalty as they cover the
+ entire packet. As the contents of the packet is typically
+ covered by L3 and L4 checksums, this additional checksum only
+ adds value for the GRE and encapsulated Ethernet headers.
+ Default is disabled, set to true to enable.
+
+
+
df_inherit
+
Optional. If enabled, the Don't Fragment bit will be copied
+ from the inner IP headers (those of the encapsulated traffic)
+ to the outer (tunnel) headers. Default is disabled; set to
+ true to enable.
+
+
+
df_default
+
Optional. If enabled, the Don't Fragment bit will be set by
+ default on tunnel headers if the df_inherit option
+ is not set, or if the encapsulated packet is not IP. Default
+ is enabled; set to false to disable.
+
+
+
pmtud
+
Optional. Enable tunnel path MTU discovery. If enabled
+ ``ICMP Destination Unreachable - Fragmentation Needed''
+ messages will be generated for IPv4 packets with the DF bit set
+ and IPv6 packets above the minimum MTU if the packet size
+ exceeds the path MTU minus the size of the tunnel headers.
+ Note that this option causes behavior that is typically
+ reserved for routers and therefore is not entirely in
+ compliance with the IEEE 802.1D specification for bridges.
+ Default is enabled; set to false to disable.
+
+
+
capwap
+
Ethernet tunneling over the UDP transport portion of CAPWAP
+ (RFC 5415). This allows interoperability with certain switches
+ where GRE is not available. Note that only the tunneling component
+ of the protocol is implemented. Due to the non-standard use of
+ CAPWAP, UDP ports 58881 and 58882 are used as the source and
+ destination ports respectively. Each tunnel must be uniquely
+ identified by the combination of
+ and
+ . If two ports are defined
+ that are the same except one includes
+ and the other does not, the
+ more specific one is matched first. CAPWAP support is not
+ available on all platforms. Currently it is only supported in the
+ Linux kernel module with kernel versions >= 2.6.25. The following
+ options may be specified in the column:
+
+
remote_ip
+
Required. The tunnel endpoint.
+
+
+
local_ip
+
Optional. The destination IP that received packets must
+ match. Default is to match all addresses.
+
+
+
tos
+
Optional. The value of the ToS bits to be set on the
+ encapsulating packet. It may also be the word
+ inherit, in which case the ToS will be copied from
+ the inner packet if it is IPv4 or IPv6 (otherwise it will be
+ 0). Note that the ECN fields are always inherited. Default is
+ 0.
+
+
+
ttl
+
Optional. The TTL to be set on the encapsulating packet.
+ It may also be the word inherit, in which case the
+ TTL will be copied from the inner packet if it is IPv4 or IPv6
+ (otherwise it will be the system default, typically 64).
+ Default is the system default TTL.
+
+
+
df_inherit
+
Optional. If enabled, the Don't Fragment bit will be copied
+ from the inner IP headers (those of the encapsulated traffic)
+ to the outer (tunnel) headers. Default is disabled; set to
+ true to enable.
+
+
+
df_default
+
Optional. If enabled, the Don't Fragment bit will be set by
+ default on tunnel headers if the df_inherit option
+ is not set, or if the encapsulated packet is not IP. Default
+ is enabled; set to false to disable.
+
+
+
pmtud
+
Optional. Enable tunnel path MTU discovery. If enabled
+ ``ICMP Destination Unreachable - Fragmentation Needed''
+ messages will be generated for IPv4 packets with the DF bit set
+ and IPv6 packets above the minimum MTU if the packet size
+ exceeds the path MTU minus the size of the tunnel headers.
+ Note that this option causes behavior that is typically
+ reserved for routers and therefore is not entirely in
+ compliance with the IEEE 802.1D specification for bridges.
+ Default is enabled; set to false to disable.
+
+
+
header_cache
+
Optional. Enable caching of tunnel headers and the output
+ path. This can lead to a significant performance increase
+ without changing behavior. In general it should not be
+ necessary to adjust this setting. However, the caching can
+ bypass certain components of the IP stack (such as IP tables)
+ and it may be useful to disable it if these features are
+ required or as a debugging measure. Default is enabled, set to
+ false to disable.
+
+
+
patch
+
+
+ A pair of virtual devices that act as a patch cable. The column must have the following key-value pair:
+
+
+
peer
+
+ The of the for
+ the other side of the patch. The named 's own peer option must specify
+ this 's name. That is, the two patch
+ interfaces must have reversed and
+ peer values.
+
+
+
+
null
+
An ignored interface.
@@ -359,70 +1152,508 @@
+
+
+ Status information about interfaces attached to bridges, updated every
+ 5 seconds. Not all interfaces have all of these properties; virtual
+ interfaces don't have a link speed, for example. Non-applicable
+ columns will have empty values.
+
+
+
+ The administrative state of the physical network link.
+
+
+
+
+
+ The observed state of the physical network link. This is ordinarily
+ the link's carrier status. If the interface's is
+ a bond configured for miimon monitoring, it is instead the network
+ link's miimon status.
+
+
+
+
+
+ The negotiated speed of the physical network link.
+ Valid values are positive integers greater than 0.
+
+
+
+
+
+ The duplex mode of the physical network link.
+
+
+
+
+
+ The MTU (maximum transmission unit); i.e. the largest
+ amount of data that can fit into a single Ethernet frame.
+ The standard Ethernet MTU is 1500 bytes. Some physical media
+ and many kinds of virtual interfaces can be configured with
+ higher MTUs.
+
+
+ This column will be empty for an interface that does not
+ have an MTU as, for example, some kinds of tunnels do not.
+
+
+
+
+
+ Key-value pairs that report port status. Supported status values are
+ -dependent; some interfaces may not have a valid
+ , for example.
+
+
The currently defined key-value pairs are:
+
+
driver_name
+
The name of the device driver controlling the network
+ adapter.
+
+
+
driver_version
+
The version string of the device driver controlling the
+ network adapter.
+
+
+
firmware_version
+
The version string of the network adapter's firmware, if
+ available.
+
+
+
source_ip
+
The source IP address used for an IPv4 tunnel end-point,
+ such as gre or capwap.
+
+
+
tunnel_egress_iface
+
Egress interface for tunnels. Currently only relevant for GRE
+ and CAPWAP tunnels. On Linux systems, this column will show
+ the name of the interface which is responsible for routing
+ traffic destined for the configured
+ . This could be an
+ internal interface such as a bridge port.
+
+
+
tunnel_egress_iface_carrier
+
Whether a carrier is detected on
+ . Valid values
+ are down and up.
+
+
+
+
+
+ These settings control ingress policing for packets received on this
+ interface. On a physical interface, this limits the rate at which
+ traffic is allowed into the system from the outside; on a virtual
+ interface (one connected to a virtual machine), this limits the rate at
+ which the VM is able to transmit.
+
+
+ Policing is a simple form of quality-of-service that simply drops
+ packets received in excess of the configured rate. Due to its
+ simplicity, policing is usually less accurate and less effective than
+ egress QoS (which is configured using the and tables).
+
+
+ Policing is currently implemented only on Linux. The Linux
+ implementation uses a simple ``token bucket'' approach:
+
+
+
+ The size of the bucket corresponds to . Initially the bucket is full.
+
+
+ Whenever a packet is received, its size (converted to tokens) is
+ compared to the number of tokens currently in the bucket. If the
+ required number of tokens are available, they are removed and the
+ packet is forwarded. Otherwise, the packet is dropped.
+
+
+ Whenever it is not full, the bucket is refilled with tokens at the
+ rate specified by .
+
+
+
+ Policing interacts badly with some network protocols, and especially
+ with fragmented IP packets. Suppose that there is enough network
+ activity to keep the bucket nearly empty all the time. Then this token
+ bucket algorithm will forward a single packet every so often, with the
+ period depending on packet size and on the configured rate. All of the
+ fragments of an IP packets are normally transmitted back-to-back, as a
+ group. In such a situation, therefore, only one of these fragments
+ will be forwarded and the rest will be dropped. IP does not provide
+ any way for the intended recipient to ask for only the remaining
+ fragments. In such a case there are two likely possibilities for what
+ will happen next: either all of the fragments will eventually be
+ retransmitted (as TCP will do), in which case the same problem will
+ recur, or the sender will not realize that its packet has been dropped
+ and data will simply be lost (as some UDP-based protocols will do).
+ Either way, it is possible that no forward progress will ever occur.
+
+
+
+ Maximum rate for data received on this interface, in kbps. Data
+ received faster than this rate is dropped. Set to 0
+ (the default) to disable policing.
+
+
+
Maximum burst size for data received on this interface, in kb. The
default burst size if set to 0 is 1000 kb. This value
has no effect if
is 0.
-
The burst size should be at least the size of the interface's
- MTU.
+
+ Specifying a larger burst size lets the algorithm be more forgiving,
+ which is important for protocols like TCP that react severely to
+ dropped packets. The burst size should be at least the size of the
+ interface's MTU. Specifying a value that is numerically at least as
+ large as 10% of helps TCP come
+ closer to achieving the full rate.
+
+
-
-
Maximum rate for data received on this interface, in kbps. Data
- received faster than this rate is dropped. Set to 0 to
- disable policing.
-
The meaning of ``ingress'' is from Open vSwitch's perspective. If
- configured on a physical interface, then it limits the rate at which
- traffic is allowed into the system from the outside. If configured
- on a virtual interface that is connected to a virtual machine, then
- it limits the rate at which the guest is able to transmit.
+
+
+ 802.1ag Connectivity Fault Management (CFM) allows a group of
+ Maintenance Points (MPs) called a Maintenance Association (MA) to
+ detect connectivity problems with each other. MPs within a MA should
+ have complete and exclusive interconnectivity. This is verified by
+ occasionally broadcasting Continuity Check Messages (CCMs) at a
+ configurable transmission interval.
+
+
+
+ A Maintenance Point ID (MPID) uniquely identifies each endpoint within
+ a Maintenance Association. The MPID is used to identify this endpoint
+ to other Maintenance Points in the MA. Each end of a link being
+ monitored should have a different MPID. Must be configured to enable
+ CFM on this .
+
+
+
+ The MPID of the remote endpoint being monitored. If this
+ does not have connectivity to an endpoint
+ advertising the configured MPID, a fault is signalled. Must be
+ configured to enable CFM on this
+
+
+
+ Indicates a connectivity fault triggered by an inability to receive
+ heartbeats from the remote endpoint. When a fault is triggered on
+ s participating in bonds, they will be
+ disabled.
+
+
+ Boolean value indicating LACP status for this interface. If true, this
+ interface has current LACP information about its LACP partner. This
+ information may be used to monitor the health of interfaces in a LACP
+ enabled port. This column will be empty if LACP is not enabled.
+
+
- Key-value pairs that identify this interface's role in external
- systems. The currently defined key-value pairs are:
+ Key-value pairs for use by external frameworks that integrate
+ with Open vSwitch, rather than by Open vSwitch itself. System
+ integrators should either use the Open vSwitch development
+ mailing list to coordinate on common key-value definitions, or
+ choose key names that are likely to be unique. The currently
+ defined common key-value pairs are:
+
+
attached-mac
+
+ The MAC address programmed into the ``virtual hardware'' for this
+ interface, in the form
+ xx:xx:xx:xx:xx:xx.
+ For Citrix XenServer, this is the value of the MAC
+ field in the VIF record for this interface.
+
iface-id
+
A system-unique identifier for the interface. On XenServer,
+ this will commonly be the same as
+ .
+
+
+ Additionally the following key-value pairs specifically
+ apply to an interface that represents a virtual Ethernet interface
+ connected to a virtual machine. These key-value pairs should not be
+ present for other types of interfaces. Keys whose names end
+ in -uuid have values that uniquely identify the entity
+ in question. For a Citrix XenServer hypervisor, these values are
+ UUIDs in RFC 4122 format. Other hypervisors may use other
+ formats.
+
+
The currently defined key-value pairs for XenServer are:
xs-vif-uuid
-
UUID of the Citrix XenServer VIF associated with this
- interface.
+
The virtual interface associated with this interface.
xs-network-uuid
-
UUID of the Citrix XenServer network to which this interface is
- attached.
-
xs-vif-vm-uuid
-
UUID of the Citrix XenServer VM to which this interface
- belongs.
-
xs-vif-mac
-
The value of the "MAC" field in the Citrix XenServer VIF record
- for this interface.
+
The virtual network to which this interface is attached.
+
xs-vm-uuid
+
The VM to which this interface belongs.
+
+
+ Key-value pairs for rarely used interface features.
+
+
cfm_interval
+
The transmission interval of CFM heartbeats in milliseconds.
+ Three missed heartbeat receptions indicate a connectivity fault.
+ Defaults to 1000ms.
+
bond-stable-id
+
A positive integer using in stable bond mode to
+ make slave selection decisions. Allocating
+ values
+ consistently across interfaces participating in a bond will
+ guarantee consistent slave selection decisions across
+ ovs-vswitchd instances when using stable
+ bonding mode.
+
lacp-port-id
+
The LACP port ID of this . Port IDs are
+ used in LACP negotiations to identify individual ports
+ participating in a bond. Must be a number between 1 and
+ 65535.
+
lacp-port-priority
+
The LACP port priority of this . In
+ LACP negotiations s with numerically lower
+ priorities are preferred for aggregation. Must be a number between
+ 1 and 65535.
+
lacp-aggregation-key
+
The LACP aggregation key of this .
+ s with different aggregation keys may not
+ be active within a given at the same time. Must
+ be a number between 1 and 65535.
+
+
+
+
+
+ Key-value pairs that report interface statistics. The current
+ implementation updates these counters periodically. In the future,
+ we plan to, instead, update them when an interface is created, when
+ they are queried (e.g. using an OVSDB select operation),
+ and just before an interface is deleted due to virtual interface
+ hot-unplug or VM shutdown, and perhaps at other times, but not on any
+ regular periodic basis.
+
+ The currently defined key-value pairs are listed below. These are
+ the same statistics reported by OpenFlow in its struct
+ ofp_port_stats structure. If an interface does not support a
+ given statistic, then that pair is omitted.
+
+
+ Successful transmit and receive counters:
+
+
rx_packets
+
Number of received packets.
+
rx_bytes
+
Number of received bytes.
+
tx_packets
+
Number of transmitted packets.
+
tx_bytes
+
Number of transmitted bytes.
+
+
+
+ Receive errors:
+
+
rx_dropped
+
Number of packets dropped by RX.
+
rx_frame_err
+
Number of frame alignment errors.
+
rx_over_err
+
Number of packets with RX overrun.
+
rx_crc_err
+
Number of CRC errors.
+
rx_errors
+
+ Total number of receive errors, greater than or equal
+ to the sum of the above.
+
+
+
+
+ Transmit errors:
+
+
tx_dropped
+
Number of packets dropped by TX.
+
collisions
+
Number of collisions.
+
tx_errors
+
+ Total number of transmit errors, greater
+ than or equal to the sum of the above.
+
+
+
+
+
-
+
+
Quality of Service (QoS) configuration for each Port that
+ references it.
+
+
+
The type of QoS to implement. The column in the table
+ identifies the types that a switch actually supports. The currently
+ defined types are listed below:
+
+
linux-htb
+
+ Linux ``hierarchy token bucket'' classifier. See tc-htb(8) (also at
+ http://linux.die.net/man/8/tc-htb) and the HTB manual
+ (http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm)
+ for information on how this classifier works and how to configure it.
+
+
+
+
linux-hfsc
+
+ Linux "Hierarchical Fair Service Curve" classifier.
+ See http://linux-ip.net/articles/hfsc.en/ for
+ information on how this classifier works.
+
+
+
+
+
+
A map from queue numbers to records. The
+ supported range of queue numbers depend on . The
+ queue numbers are the same as the queue_id used in
+ OpenFlow in struct ofp_action_enqueue and other
+ structures. Queue 0 is used by OpenFlow output actions that do not
+ specify a specific queue.
+
+
+
+
Key-value pairs for configuring QoS features that depend on
+ .
+
The linux-htb and linux-hfsc classes support
+ the following key-value pairs:
+
+
max-rate
+
Maximum rate shared by all queued traffic, in bit/s.
+ Optional. If not specified, for physical interfaces, the
+ default is the link rate. For other interfaces or if the
+ link rate cannot be determined, the default is currently 100
+ Mbps.
+
+
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
+
+
+
+
A configuration for a port output queue, used in configuring Quality of
+ Service (QoS) features. May be referenced by column in table.
+
+
+
Key-value pairs for configuring the output queue. The supported
+ key-value pairs and their meanings depend on the
+ of the records that reference this row.
+
The key-value pairs defined for of min-rate are:
+
+
min-rate
+
Minimum guaranteed bandwidth, in bit/s. Required. The
+ floor value is 1500 bytes/s (12,000 bit/s).
+
+
The key-value pairs defined for of linux-htb are:
+
+
min-rate
+
Minimum guaranteed bandwidth, in bit/s.
+
max-rate
+
Maximum allowed bandwidth, in bit/s. Optional. If specified, the
+ queue's rate will not be allowed to exceed the specified value, even
+ if excess bandwidth is available. If unspecified, defaults to no
+ limit.
+
burst
+
Burst size, in bits. This is the maximum amount of ``credits''
+ that a queue can accumulate while it is idle. Optional. Details of
+ the linux-htb implementation require a minimum burst
+ size, so a too-small burst will be silently
+ ignored.
+
priority
+
A nonnegative 32-bit integer. Defaults to 0 if
+ unspecified. A queue with a smaller priority
+ will receive all the excess bandwidth that it can use before
+ a queue with a larger value receives any. Specific priority
+ values are unimportant; only relative ordering matters.
+
+
The key-value pairs defined for of linux-hfsc are:
+
+
min-rate
+
Minimum guaranteed bandwidth, in bit/s.
+
max-rate
+
Maximum allowed bandwidth, in bit/s. Optional. If specified, the
+ queue's rate will not be allowed to exceed the specified value, even
+ if excess bandwidth is available. If unspecified, defaults to no
+ limit.
+
+
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
+
+
+
A port mirror within a .
A port mirror configures a bridge to send selected frames to special
- ``mirrored'' ports, in addition to their normal destinations. Mirroring
- traffic may also be referred to as SPAN or RSPAN, depending on the
- mechanism used for delivery.
+ ``mirrored'' ports, in addition to their normal destinations. Mirroring
+ traffic may also be referred to as SPAN, RSPAN, or ERSPAN, depending on how
+ the mirrored traffic is sent.
Arbitrary identifier for the .
+
+ To be selected for mirroring, a given packet must enter or leave the
+ bridge through a selected port and it must also be in one of the
+ selected VLANs.
+
+
+
+ If true, every packet arriving or departing on any port is
+ selected for mirroring.
+
+
Ports on which departing packets are selected for mirroring.
- Ports on which arriving packets are selected for mirroring. If this
- column and are both empty, then all
- packets on all ports are selected for mirroring.
+ Ports on which arriving packets are selected for mirroring.
@@ -432,19 +1663,26 @@
+
+ These columns are mutually exclusive. Exactly one of them must be
+ nonempty.
+
+
-
Output port for selected packets, if nonempty. Mutually exclusive
- with .
+
Output port for selected packets, if nonempty.
Specifying a port for mirror output reserves that port exclusively
- for mirroring. No frames other than those selected for mirroring
- will be forwarded to the port, and any frames received on the port
- will be discarded.
-
This type of mirroring is sometimes called SPAN.
+ for mirroring. No frames other than those selected for mirroring
+ will be forwarded to the port, and any frames received on the port
+ will be discarded.
+
+ The output port may be any kind of port supported by Open vSwitch.
+ It may be, for example, a physical port (sometimes called SPAN), or a
+ GRE tunnel (sometimes called ERSPAN).
+
-
Output VLAN for selected packets, if nonempty. Mutually exclusive
- with .
+
Output VLAN for selected packets, if nonempty.
The frames will be sent out all ports that trunk
, as well as any ports with implicit VLAN
. When a mirrored frame is sent out a
@@ -452,6 +1690,37 @@
, replacing any existing tag; when it is
sent out an implicit VLAN port, the frame will not be tagged. This
type of mirroring is sometimes called RSPAN.
+
+ The following destination MAC addresses will not be mirrored to a
+ VLAN to avoid confusing switches that interpret the protocols that
+ they represent:
+
Please note: Mirroring to a VLAN can disrupt a network that
contains unmanaged switches. Consider an unmanaged physical switch
with two ports: port 1, connected to an end host, and port 2,
@@ -477,26 +1746,101 @@
Open vSwitch is being used as an intermediate switch, learning can be
disabled by adding the mirrored VLAN to
in the appropriate table or tables.
+
+ Mirroring to a GRE tunnel has fewer caveats than mirroring to a
+ VLAN and should generally be preferred.
+
+
+
+
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
- An OpenFlow controller.
+
An OpenFlow controller.
+
+
+ Open vSwitch supports two kinds of OpenFlow controllers:
+
+
+
+
Primary controllers
+
+
+ This is the kind of controller envisioned by the OpenFlow 1.0
+ specification. Usually, a primary controller implements a network
+ policy by taking charge of the switch's flow table.
+
+
+
+ Open vSwitch initiates and maintains persistent connections to
+ primary controllers, retrying the connection each time it fails or
+ drops. The column in the
+ table applies to primary controllers.
+
+
+
+ Open vSwitch permits a bridge to have any number of primary
+ controllers. When multiple controllers are configured, Open
+ vSwitch connects to all of them simultaneously. Because
+ OpenFlow 1.0 does not specify how multiple controllers
+ coordinate in interacting with a single switch, more than
+ one primary controller should be specified only if the
+ controllers are themselves designed to coordinate with each
+ other. (The Nicira-defined NXT_ROLE OpenFlow
+ vendor extension may be useful for this.)
+
+
+
Service controllers
+
+
+ These kinds of OpenFlow controller connections are intended for
+ occasional support and maintenance use, e.g. with
+ ovs-ofctl. Usually a service controller connects only
+ briefly to inspect or modify some of a switch's state.
+
+
+
+ Open vSwitch listens for incoming connections from service
+ controllers. The service controllers initiate and, if necessary,
+ maintain the connections from their end. The column in the table does
+ not apply to service controllers.
+
+
+
+ Open vSwitch supports configuring any number of service controllers.
+
+
+
+
+
+ The determines the type of controller.
+
- Connection method for controller.
- The following connection methods are currently
- supported:
+
Connection method for controller.
+
+ The following connection methods are currently supported for primary
+ controllers:
+
ssl:ip[:port]
The specified SSL port (default: 6633) on the host at
- the given ip, which must be expressed as an IP address
- (not a DNS name). The
- column in the must point to a valid
- SSL configuration when this form is used.
+ the given ip, which must be expressed as an IP address
+ (not a DNS name). The
+ column in the table must point to a
+ valid SSL configuration when this form is used.
SSL support is an optional feature that is not always built as
part of Open vSwitch.
@@ -504,16 +1848,66 @@
The specified TCP port (default: 6633) on the host at
the given ip, which must be expressed as an IP address
(not a DNS name).
-
discover
-
Enables controller discovery.
-
none
-
Disables the controller.
+
+ The following connection methods are currently supported for service
+ controllers:
+
+
+
pssl:[port][:ip]
+
+
+ Listens for SSL connections on the specified TCP port
+ (default: 6633). If ip, which must be expressed as an
+ IP address (not a DNS name), is specified, then connections are
+ restricted to the specified local IP address.
+
+
+ The column in the table must point to a valid SSL
+ configuration when this form is used.
+
+
SSL support is an optional feature that is not always built as
+ part of Open vSwitch.
+
+
ptcp:[port][:ip]
+
+ Listens for connections on the specified TCP port
+ (default: 6633). If ip, which must be expressed as an
+ IP address (not a DNS name), is specified, then connections are
+ restricted to the specified local IP address.
+
+
+
When multiple controllers are configured for a single bridge, the
+ values must be unique. Duplicate
+ values yield unspecified results.
- Either in-band or out-of-band. If not
- specified, the default is implementation-specific.
+
If it is specified, this setting must be one of the following
+ strings that describes how Open vSwitch contacts this OpenFlow
+ controller over the network:
+
+
+
in-band
+
In this mode, this controller's OpenFlow traffic travels over the
+ bridge associated with the controller. With this setting, Open
+ vSwitch allows traffic to and from the controller regardless of the
+ contents of the OpenFlow flow table. (Otherwise, Open vSwitch
+ would never be able to connect to the controller, because it did
+ not have a flow to enable it.) This is the most common connection
+ mode because it is not necessary to maintain two independent
+ networks.
+
out-of-band
+
In this mode, OpenFlow traffic uses a control network separate
+ from the bridge associated with this controller, that is, the
+ bridge does not use any of its own network devices to communicate
+ with the controller. The control network must be configured
+ separately, before or after ovs-vswitchd is started.
+
+
+
+
If not specified, the default is implementation-specific.
@@ -530,47 +1924,12 @@
number of seconds, it will send a probe. If a response is not
received for the same additional amount of time, Open vSwitch
assumes the connection has been broken and attempts to reconnect.
- Default is implementation-specific.
-
-
-
-
When a controller is configured, it is, ordinarily, responsible
- for setting up all flows on the switch. Thus, if the connection to
- the controller fails, no new network connections can be set up.
- If the connection to the controller stays down long enough,
- no packets can pass through the switch at all. This setting
- determines the switch's response to such a situation. It may be set
- to one of the following:
-
-
standalone
-
If no message is received from the controller for three
- times the inactivity probe interval
- (see ), then Open vSwitch
- will take over responsibility for setting up flows. In
- this mode, Open vSwitch causes the datapath to act like an
- ordinary MAC-learning switch. Open vSwitch will continue
- to retry connecting to the controller in the background
- and, when the connection succeeds, it will discontinue its
- standalone behavior.
-
secure
-
Open vSwitch will not set up flows on its own when the
- controller connection fails. It will continue retry
- connecting to the controller forever.
-
-
-
If this value is unset, the default is
- implementation-specific.
+ Default is implementation-specific. A value of 0 disables
+ inactivity probes.
-
- In conjunction with ,
- the maximum number of unused packet credits that the bridge will
- allow to accumulate, in packets. If not specified, the default
- is implementation-specific.
-
-
The maximum rate at which packets in unknown flows will be
forwarded to the OpenFlow controller, in packets per second. This
@@ -590,42 +1949,314 @@
actual rate that packets are sent to the controller is up to
twice the specified rate.
+
+
+ In conjunction with ,
+ the maximum number of unused packet credits that the bridge will
+ allow to accumulate, in packets. If not specified, the default
+ is implementation-specific.
+
-
-
- If is discover, a POSIX
- extended regular expression against which the discovered controller
- location is validated. The regular expression is implicitly
- anchored at the beginning of the controller location string, as
- if it begins with ^. If not specified, the default
- is implementation-specific.
+
+
These values are considered only in in-band control mode (see
+ ).
+
+
When multiple controllers are configured on a single bridge, there
+ should be only one set of unique values in these columns. If different
+ values are set for these columns in different controllers, the effect
+ is unspecified.
+
+
+ The IP address to configure on the local port,
+ e.g. 192.168.0.123. If this value is unset, then
+ and are
+ ignored.
-
- If is discover,
- whether to update /etc/resolv.conf when the
- controller is discovered. If not specified, the default
- is implementation-specific. Open vSwitch will only modify
- /etc/resolv.conf if the DHCP response that it receives
- specifies one or more DNS servers.
+
+ The IP netmask to configure on the local port,
+ e.g. 255.255.255.0. If is set
+ but this value is unset, then the default is chosen based on whether
+ the IP address is class A, B, or C.
-
-
- If is not discover, the IP
- address of the gateway to configure on the local port.
+ The IP address of the gateway to configure on the local port, as a
+ string, e.g. 192.168.0.1. Leave this column unset if
+ this network has no gateway.
+
-
- If is not discover, the IP
- address to configure on the local port.
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
-
- If is not discover, the IP
- netmask to configure on the local port.
+
+
+ true if currently connected to this controller,
+ false otherwise.
+
+
+
+
The level of authority this controller has on the associated
+ bridge. Possible values are:
+
+
other
+
Allows the controller access to all OpenFlow features.
+
master
+
Equivalent to other, except that there may be at
+ most one master controller at a time. When a controller configures
+ itself as master, any existing master is demoted to
+ the slaverole.
+
slave
+
Allows the controller read-only access to OpenFlow features.
+ Attempts to modify the flow table will be rejected with an
+ error. Slave controllers do not receive OFPT_PACKET_IN or
+ OFPT_FLOW_REMOVED messages, but they do receive OFPT_PORT_STATUS
+ messages.
+
+
+
+
+
Key-value pairs that report controller status.
+
+
last_error
+
A human-readable description of the last error on the connection
+ to the controller; i.e. strerror(errno). This key
+ will exist only if an error has occurred.
+
state
+
The state of the connection to the controller. Possible values
+ are: VOID (connection is disabled),
+ BACKOFF (attempting to reconnect at an increasing
+ period), CONNECTING (attempting to connect),
+ ACTIVE (connected, remote host responsive), and
+ IDLE (remote host idle, sending keep-alive). These
+ values may change in the future. They are provided only for human
+ consumption.
+
sec_since_connect
+
The amount of time since this controller last successfully
+ connected to the switch (in seconds). Value is empty if controller
+ has never successfully connected.
+
sec_since_disconnect
+
The amount of time since this controller last disconnected from
+ the switch (in seconds). Value is empty if controller has never
+ disconnected.
+
+
+
+
+
+
+
+ Configuration for a database connection to an Open vSwitch database
+ (OVSDB) client.
+
+
+
+ This table primarily configures the Open vSwitch database
+ (ovsdb-server), not the Open vSwitch switch
+ (ovs-vswitchd). The switch does read the table to determine
+ what connections should be treated as in-band.
+
+
+
+ The Open vSwitch database server can initiate and maintain active
+ connections to remote clients. It can also listen for database
+ connections.
+
+
+
+
+
Connection method for managers.
+
+ The following connection methods are currently supported:
+
+
+
ssl:ip[:port]
+
+
+ The specified SSL port (default: 6632) on the host at
+ the given ip, which must be expressed as an IP address
+ (not a DNS name). The
+ column in the table must point to a
+ valid SSL configuration when this form is used.
+
+
+ SSL support is an optional feature that is not always built as
+ part of Open vSwitch.
+
+
+
+
tcp:ip[:port]
+
+ The specified TCP port (default: 6632) on the host at
+ the given ip, which must be expressed as an IP address
+ (not a DNS name).
+
+
pssl:[port][:ip]
+
+
+ Listens for SSL connections on the specified TCP port
+ (default: 6632). If ip, which must be expressed as an
+ IP address (not a DNS name), is specified, then connections are
+ restricted to the specified local IP address.
+
+
+ The column in the table must point to a valid SSL
+ configuration when this form is used.
+
+
+ SSL support is an optional feature that is not always built as
+ part of Open vSwitch.
+
+
+
ptcp:[port][:ip]
+
+ Listens for connections on the specified TCP port
+ (default: 6632). If ip, which must be expressed as an
+ IP address (not a DNS name), is specified, then connections are
+ restricted to the specified local IP address.
+
+
+
When multiple managers are configured, the
+ values must be unique. Duplicate values yield
+ unspecified results.
+
+
+
+
+ If it is specified, this setting must be one of the following strings
+ that describes how Open vSwitch contacts this OVSDB client over the
+ network:
+
+
+
+
in-band
+
+ In this mode, this connection's traffic travels over a bridge
+ managed by Open vSwitch. With this setting, Open vSwitch allows
+ traffic to and from the client regardless of the contents of the
+ OpenFlow flow table. (Otherwise, Open vSwitch would never be able
+ to connect to the client, because it did not have a flow to enable
+ it.) This is the most common connection mode because it is not
+ necessary to maintain two independent networks.
+
+
out-of-band
+
+ In this mode, the client's traffic uses a control network separate
+ from that managed by Open vSwitch, that is, Open vSwitch does not
+ use any of its own network devices to communicate with the client.
+ The control network must be configured separately, before or after
+ ovs-vswitchd is started.
+
+
+
+
+ If not specified, the default is implementation-specific.
+
+
+
+
+
+
+ Maximum number of milliseconds to wait between connection attempts.
+ Default is implementation-specific.
+
+
+
+ Maximum number of milliseconds of idle time on connection to the client
+ before sending an inactivity probe message. If Open vSwitch does not
+ communicate with the client for the specified number of seconds, it
+ will send a probe. If a response is not received for the same
+ additional amount of time, Open vSwitch assumes the connection has been
+ broken and attempts to reconnect. Default is implementation-specific.
+ A value of 0 disables inactivity probes.
+
+
+
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
+
+
+
+
+ true if currently connected to this manager,
+ false otherwise.
+
+
+
+
Key-value pairs that report manager status.
+
+
last_error
+
A human-readable description of the last error on the connection
+ to the manager; i.e. strerror(errno). This key
+ will exist only if an error has occurred.
+
+
+
state
+
The state of the connection to the manager. Possible values
+ are: VOID (connection is disabled),
+ BACKOFF (attempting to reconnect at an increasing
+ period), CONNECTING (attempting to connect),
+ ACTIVE (connected, remote host responsive), and
+ IDLE (remote host idle, sending keep-alive). These
+ values may change in the future. They are provided only for human
+ consumption.
+
+
+
sec_since_connect
+
The amount of time since this manager last successfully connected
+ to the database (in seconds). Value is empty if manager has never
+ successfully connected.
+
+
+
sec_since_disconnect
+
The amount of time since this manager last disconnected from the
+ database (in seconds). Value is empty if manager has never
+ disconnected.
+
+
+
locks_held
+
locks_waiting
+
locks_lost
+
+ Space-separated lists of the names of OVSDB locks that the
+ connection holds, is currently waiting to acquire, or has had
+ stolen by another OVSDB client, respectively. Key-value pairs for
+ lists that would be empty are omitted.
+
+
+
+
n_connections
+
+
+ When specifies a connection method that
+ listens for inbound connections (e.g. ptcp: or
+ pssl:) and more than one connection is actually
+ active, the value is the number of active connections.
+ Otherwise, this key-value pair is omitted.
+
+
+ When multiple connections are active, status columns and
+ key-value pairs (other than this one) report the status of one
+ arbitrarily chosen connection.
+
+
+
@@ -669,6 +2300,14 @@
disambiguate the traffic.
When this option is enabled, a maximum of 508 ports are supported.
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
@@ -701,6 +2340,14 @@
SSL connection to a man-in-the-middle attack obtaining the initial
CA certificate. It may still be useful for bootstrapping.
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
@@ -708,10 +2355,11 @@
of switches.
- IP address to report as ``agent address'' to collectors. If not
- specified, defaults to the in
- the collector's . If neither is specified,
- sFlow is disabled.
+ Name of the network device whose IP address should be reported as the
+ ``agent address'' to collectors. If not specified, the IP address
+ defaults to the in the
+ collector's . If an agent IP address cannot be
+ determined either way, sFlow is disabled.
@@ -734,5 +2382,55 @@
sFlow targets in the form
ip:port.
+
+
+ Key-value pairs for use by external frameworks that integrate with Open
+ vSwitch, rather than by Open vSwitch itself. System integrators should
+ either use the Open vSwitch development mailing list to coordinate on
+ common key-value definitions, or choose key names that are likely to be
+ unique. No common key-value pairs are currently defined.
+
+
+
+
+
Records in this table describe functionality supported by the hardware
+ and software platform on which this Open vSwitch is based. Clients
+ should not modify this table.
+
+
A record in this table is meaningful only if it is referenced by the
+ column in the
+ table. The key used to reference it, called
+ the record's ``category,'' determines the meanings of the
+ column. The following general forms of
+ categories are currently defined:
+
+
+
qos-type
+
type is supported as the value for
+ in the table.
+
+
+
+
+
Key-value pairs that describe capabilities. The meaning of the pairs
+ depends on the category key that the column in the table
+ uses to reference this record, as described above.
+
+
The presence of a record for category qos-type
+ indicates that the switch supports type as the value of
+ the column in the
+ table. The following key-value pairs are defined to further describe
+ QoS capabilities:
+
+
+
n-queues
+
Number of supported queues, as a positive integer. Keys in the
+ column for
+ records whose value
+ equals type must range between 0 and this value minus one,
+ inclusive.