OpenFlow 命令

OpenFlow 命令

创建一个OVS交换机

1. ovs-vsctl add-br ovs-switch

复制代码

创建一个端口 p0，设置端口 p0 的 OpenFlow 端口编号为 100

1. ovs-vsctl add-port ovs-switch p0 -- set Interface p0 ofport_request=100

复制代码

设置网络接口设备类型为”internal”,

1. ovs-vsctl set Interface p0 type=internal

复制代码

查看设置结果

1. ethtool -i p0

复制代码

1. driver: openvswitch
   
2. version: 
   
3. firmware-version: 
   
4. bus-info: 
   
5. supports-statistics: no
   
6. supports-test: no
   
7. supports-eeprom-access: no
   
8. supports-register-dump: no
   
9. supports-priv-flags: no

复制代码

 

创建一个name space：ns0，把p0端口接入到ns0里，并且配置ip地址 192.168.1.100/24

1. ip netns add ns0
   
2. ip link set p0 netns ns0
   
3. ip netns exec ns0 ip addr add 192.168.1.100/24 dev p0
   
4. ip netns exec ns0 ifconfig p0 promisc up

复制代码

查看创建结果

1. ovs-vsctl show
   
2. 6507c214-0c7a-4159-9813-977074f73aa1
   
3.     Bridge ovs-switch
   
4.         Port "p0"
   
5.             Interface "p0"
   
6.                 type: internal
   
7.         Port ovs-switch
   
8.             Interface ovs-switch
   
9.                 type: internal
   
10.     ovs_version: "2.0.2"

复制代码

重复步骤，创建p1和p2端口

1. ovs-vsctl add-port ovs-switch p1 -- set Interface p1 ofport_request=101
   
2. ovs-vsctl set Interface p1 type=internal
   
3. ip netns add ns1
   
4. ip link set p1 netns ns1
   
5. ip netns exec ns1 ip addr add 192.168.1.101/24 dev p1
   
6. ip netns exec ns1 ifconfig p1 promisc up

复制代码

查看创建结果

ovs-vsctl show
c402802a-dbe0-4127-9bce-e2405a4ac33d
    Bridge ovs-switch
        Port "p0"
            Interface "p0"
                type: internal
        Port ovs-switch
            Interface ovs-switch
                type: internal
        Port "p1"
            Interface "p1"
                type: internal
    ovs_version: "2.0.2"


 


创建p2

1. ovs-vsctl add-port ovs-switch p2 -- set Interface p2 ofport_request=102
   
2. ovs-vsctl set Interface p2 type=internal
   
3. ip netns add ns2
   
4. ip link set p2 netns ns2
   
5. ip netns exec ns2 ip addr add 192.168.1.102/24 dev p2
   
6. ip netns exec ns2 ifconfig p2 promisc up

复制代码

c402802a-dbe0-4127-9bce-e2405a4ac33d
    Bridge ovs-switch
        Port "p0"
            Interface "p0"
                type: internal
        Port "p2"
            Interface "p2"
                type: internal
        Port ovs-switch
            Interface ovs-switch
                type: internal
        Port "p1"
            Interface "p1"
                type: internal
    ovs_version: "2.0.2"



查看创建的交换机信息，获得dpid，端口openflow端口编号

1. ovs-ofctl show ovs-switch

复制代码

1. OFPT_FEATURES_REPLY (xid=0x2): dpid:0000c6d6454c204e
   
2. n_tables:254, n_buffers:256
   
3. capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
   
4. actions: OUTPUT SET_VLAN_VID SET_VLAN_PCP STRIP_VLAN SET_DL_SRC SET_DL_DST SET_NW_SRC SET_NW_DST SET_NW_TOS SET_TP_SRC SET_TP_DST ENQUEUE
   
5. 100(p0): addr:00:00:00:00:00:00
   
6.      config:     PORT_DOWN
   
7.      state:      LINK_DOWN
   
8.      speed: 0 Mbps now, 0 Mbps max
   
9. 101(p1): addr:00:00:00:00:00:00
   
10.      config:     PORT_DOWN
    
11.      state:      LINK_DOWN
    
12.      speed: 0 Mbps now, 0 Mbps max
    
13. 102(p2): addr:00:00:00:00:00:00
    
14.      config:     PORT_DOWN
    
15.      state:      LINK_DOWN
    
16.      speed: 0 Mbps now, 0 Mbps max
    
17. LOCAL(ovs-switch): addr:76:f1:e5:e8:19:ed
    
18.      config:     PORT_DOWN
    
19.      state:      LINK_DOWN
    
20.      speed: 0 Mbps now, 0 Mbps max
    
21. OFPT_GET_CONFIG_REPLY (xid=0x4): frags=normal miss_send_len=0

复制代码

获取openflow端口编号

1. ovs-vsctl get Interface p0 ofport

复制代码

100

1. ovs-vsctl get Interface p1 ofport

复制代码

101

1. ovs-vsctl get Interface p2 ofport

复制代码

102


查看 datapath 的信息

1. ovs-dpctl show

复制代码

1. system@ovs-system:
   
2.         lookups: hit:35 missed:21 lost:0
   
3.         flows: 0
   
4.         port 0: ovs-system (internal)
   
5.         port 1: ovs-switch (internal)
   
6.         port 2: p0 (internal)
   
7.         port 3: p1 (internal)
   
8.         port 4: p2 (internal)

复制代码

 


查看mac地址

1. ip netns exec ns0 ping 192.168.1.100
   
2. ip netns exec ns0 ping 192.168.1.101
   
3. ip netns exec ns0 ping 192.168.1.102

复制代码

这里100ping不同，原因不明

然后运行

1. ovs-appctl fdb/show ovs-switch

复制代码

1. port  VLAN  MAC                Age
   
2.   101     0  1a:19:57:65:03:f2   55
   
3.   102     0  36:54:7a:1c:c9:43   48
   
4.   100     0  36:92:12:98:4d:40   48

复制代码

查看交换机所有table

1. ovs-ofctl dump-tables ovs-switch

复制代码

 

253个table.

查看交换机中的所有流表项

1. ovs−ofctl dump−flows ovs-switch

复制代码

输出如下信息：

1. cookie=0x0, duration=1756.751s, table=0, n_packets=96, n_bytes=7784, idle_age=303, priority=0 actions=NORMAL

复制代码

删除编号为 100 的端口上的所有流表项

1. ovs-ofctl del-flows ovs-switch "in_port=100"

复制代码

查看交换机端口信息

1. ovs-ofctl show ovs-switch

复制代码

修改数据包

屏蔽所有进入 OVS 的以太网广播数据包

1. ovs-ofctl add-flow ovs-switch "table=0, dl_src=01:00:00:00:00:00/01:00:00:00:00:00, actions=drop"

复制代码

屏蔽 STP 协议的广播数据包

1. ovs-ofctl add-flow ovs-switch "table=0, dl_dst=01:80:c2:00:00:00/ff:ff:ff:ff:ff:f0, actions=drop"

复制代码

修改数据包，添加新的 OpenFlow 条目，修改从端口 p0 收到的数据包的源地址为 9.181.137.1

1. ovs-ofctl add-flow ovs-switch "priority=1 idle_timeout=0,\
   
2.     in_port=100,actions=mod_nw_src:9.181.137.1,normal"

复制代码

从端口 p0（192.168.1.100）发送测试数据到端口 p1（192.168.1.101），就是没啥响应

1. ip netns exec ns0 ping 192.168.1.101

复制代码

再打开一个ssh终端，登录进去，运行tcpdump，需要等待几分钟，才能看到响应

1. ip netns exec ns1 tcpdump -i p1 icmp

复制代码

1. ip netns exec ns1 tcpdump -i p1 icmp
   
2. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   
3. listening on p1, link-type EN10MB (Ethernet), capture size 65535 bytes
   
4. 02:40:20.212575 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 89, length 64
   
5. 02:40:21.220600 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 90, length 64
   
6. 02:40:22.228630 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 91, length 64
   
7. 02:40:23.236670 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 92, length 64
   
8. 02:40:24.244721 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 93, length 64
   
9. 02:40:25.252758 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 94, length 64
   
10. 02:40:26.260777 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 95, length 64
    
11. 02:40:27.268868 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 96, length 64
    
12. 02:40:28.276857 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 97, length 64
    
13. 02:40:29.284839 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 98, length 64
    
14. 02:40:30.292939 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 99, length 64
    
15. 02:40:31.300987 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 100, length 64
    
16. 02:40:32.308972 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 101, length 64
    
17. 02:40:33.317053 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 102, length 64
    
18. 02:40:34.325103 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 103, length 64

复制代码

重定向数据包

添加新的 OpenFlow 条目，重定向所有的 ICMP 数据包到端口 p2

1. ovs-ofctl add-flow ovs-switch idle_timeout=0,dl_type=0x0800,nw_proto=1,actions=output:102

复制代码

从端口 p0 （192.168.1.100）发送数据到端口 p1（192.168.1.101）

这个时候你从p2里，可以看到

1. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   
2. listening on p2, link-type EN10MB (Ethernet), capture size 65535 bytes
   
3. 06:25:38.252471 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 35, length 64
   
4. 06:25:39.260438 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 36, length 64
   
5. 06:25:40.268419 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 37, length 64

复制代码

修改vlan tag

修改端口 p1 的 VLAN tag 为 101，使端口 p1 成为一个隶属于 VLAN 101 的端口

1. ovs-vsctl set Port p1 tag=101

复制代码

现在由于端口 p0 和 p1 属于不同的 VLAN，它们之间无法进行数据交换。我们使用 ovs-appctl ofproto/trace 生成一个从端口 p0 发送到端口 p1 的数据包，这个数据包不包含任何 VLAN tag，并观察 OVS 的处理过程

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. dl_dst=f2:0d:06:ff:79:d7 -generate

复制代码

注意：上面第一个mac地址，是p0的，第二个mac地址是p1的，你需要替换，上面有获取mac地址的方法。

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. > dl_dst=f2:0d:06:ff:79:d7 -generate
   
3. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=1,in_port=100
   
5. OpenFlow actions=mod_nw_src:9.181.137.1,NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000/0x1fff,dl_src=d6:0f:7e:ed:11:e4,
   
10. dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_src=0.0.0.0,nw_proto=0,nw_frag=no
    
11. Datapath actions: 1,4

复制代码

在第一行输出中，“Flow:”之后的字段描述了输入的流的信息。由于我们没有指定太多信息，所以多数字段 （例如 dl_type 和 vlan_tci）被 OVS 设置为空值。

在第二行的输出中，“Rule:” 之后的字段描述了匹配成功的流表项。

在第三行的输出中，“OpenFlow actions”之后的字段描述了实际执行的操作。

最后一段以”Final flow”开始的字段是整个处理过程的总结，“Datapath actions: 4,1”代表数据包被发送到 datapath 的 4 和 1 号端口。

创建一条新的 Flow

对于从端口 p0 进入交换机的数据包，如果它不包含任何 VLAN tag，则自动为它添加 VLAN tag 101

1. ovs-ofctl add-flow ovs-switch "priority=3,in_port=100,dl_vlan=0xffff,\
   
2. actions=mod_vlan_vid:101,normal"

复制代码

再次尝试从端口 p0 发送一个不包含任何 VLAN tag 的数据包，发现数据包进入端口 p0 之后, 会被加上 VLAN tag101, 同时转发到端口 p1 上

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. > dl_dst=f2:0d:06:ff:79:d7 -generate
   
3. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=1,in_port=100
   
5. OpenFlow actions=mod_nw_src:9.181.137.1,NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000/0x1fff,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_src=0.0.0.0,nw_proto=0,nw_frag=no
   
10. Datapath actions: 1,4
    
11. root@ovs:~# ovs-ofctl add-flow ovs-switch "priority=3,in_port=100,dl_vlan=0xffff,\
    
12. > actions=mod_vlan_vid:101,normal"
    
13. root@ovs:~# ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
    
14. > dl_dst=f2:0d:06:ff:79:d7 -generate
    
15. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
    
16. Rule: table=0 cookie=0 priority=3,in_port=100,vlan_tci=0x0000
    
17. OpenFlow actions=mod_vlan_vid:101,NORMAL
    
18. no learned MAC for destination, flooding
    
19. 
    
20. Final flow: metadata=0,in_port=100,dl_vlan=101,dl_vlan_pcp=0,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
    
21. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_proto=0,nw_frag=no
    
22. Datapath actions: push_vlan(vid=101,pcp=0),1,pop_vlan,3,push_vlan(vid=101,pcp=0),4

复制代码

反过来从端口 p1 发送数据包，由于 p1 现在是带有 VLAN tag 101 的 Access 类型的端口，所以数据包进入端口 p1 之后，会被 OVS 添加 VLAN tag 101 并发送到端口 p0

1. ovs-appctl ofproto/trace ovs-switch in_port=101,dl_src=f2:0d:06:ff:79:d7,\
   
2. > dl_dst=d6:0f:7e:ed:11:e4 -generate
   
3. Flow: metadata=0,in_port=101,vlan_tci=0x0000,dl_src=f2:0d:06:ff:79:d7,dl_dst=d6:0f:7e:ed:11:e4,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=0
   
5. OpenFlow actions=NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=101,vlan_tci=0x0000,dl_src=f2:0d:06:ff:79:d7,dl_dst=d6:0f:7e:ed:11:e4,dl_type=0x0000,nw_proto=0,nw_frag=no
   
10. Datapath actions: push_vlan(vid=101,pcp=0),1,2,4

复制代码