This article provides information about OVS commands that can be used to troubleshoot OpenvSwitch related issues.

What is Open vSwitch?

Open vSwitch is a software implementation of a virtual multilayer network switch, designed to enable effective network automation through programmatic extensions, while supporting standard management interfaces and protocols such as NetFlow, sFlow, SPAN, RSPAN, CLI, LACP and 802.1ag.

OVS Base Commands

OVS is a feature rich vSwitch with different configuration commands, but the majority of the configuration and troubleshooting can be accomplished with the following four commands:

  • ovs-vsctl : Used for configuring the ovs-vswitchd configuration database (known as ovs-db)
  • ovs-ofctl : A command line tool for monitoring and administering OpenFlow switches
  • ovs-dpctl : Used to administer Open vSwitch datapaths
  • ovs−appctl : Used for querying and controlling Open vSwitch daemons

ovs-vsctl

This tool is used for configuration and viewing OVS switch operations. Port configuration, bridge additions/deletions, bonding, and VLAN tagging are just some of the options that are available with this command. Below are the most useful show commands:

ovs-vsctl –V : Prints the current version of openvswitc

ovs-vsctl show : Prints a brief overview of the switch database configuration

ovs-vsctl list-br : Prints a list of configured bridges

ovs-vsctl list-ports <bridge> : Prints a list of ports on a specific bridge

ovs-vsctl list interface : Prints a list of interfaces

The above should be fairly self explanatory. Below are the common switch configuration commands:

ovs-vsctl add-br <bridge> : Creates a bridge in the switch database.

ovs-vsctl add-port <bridge> <interface> : Binds an interface (physical or virtual) to a bridge.

ovs-vsctl add-port <bridge> <interface> tag=<VLAN number> : Converts port to an access port on specified VLAN (by default all OVS ports are VLAN trunks).

ovs-vsctl set interface <interface> type=patch options:peer=<interface> : Used to create patch ports to connect two or more bridges together.

ovs-ofctl

This tool is used for administering and monitoring OpenFlow switches. Even if OVS isn’t configured for centralized administration, ovs-ofctl can be used to show the current state of OVS including features, configuration, and table entries.

Below are common show commands:

ovs-ofctl show <bridge> : Shows OpenFlow features and port descriptions.

ovs-ofctl snoop <bridge> : Snoops traffic to and from the bridge and prints to console.

ovs-ofctl dump-flows <bridge> <flow> : Prints flow entries of specified bridge. With the flow specified, only the matching flow will be printed to console. If the flow is omitted, all flow entries of the bridge will be printed.

ovs-ofctl dump-ports-desc <bridge> : Prints port statistics. This will show detailed information about interfaces in this bridge, include the state, peer, and speed information. Very useful for viewing port connectvity and detecting errors in NIC to bridge bonding.

ovs-ofctl dump-tables-desc <bridge> : Similar to above but prints the descriptions of tables belonging to the stated bridge.

Below are the common configurations used with the ovs-ofctl tool:

ovs-ofctl add-flow <bridge> <flow> : Adds a static flow to the specified bridge. Useful in defining conditions for a flow (i.e. prioritize, drop, etc).

ovs-ofctl del-flows <bridge> <flow> : Deletes the flow entries from flow table of stated bridge. If the flow is omitted, all flows in specified bridge will be deleted.

The above commands can take many arguments regarding different field to match. They can be used for simple source/destination flow additions to complex L3 rewriting like SNAT, DNAT, etc. You can even build a functional router with them!

ovs-dpctl

ovs-dpctl is very similar to ovs-ofctl in that they both show flow table entries. The flows that ovs-dpctl prints are always an exact match and reflect packets that have actually passed through the system within the last few seconds. ovs-dpctl queries a kernel datapath and not an OpenFlow switch. This is why it’s useful for debugging flow data.

OVS uses a single datapath that is shared by all bridges of that type. In order to create a new datapath, use the following:

ovs-dpctl add-dp dp1; ovs-dpctl add-if dp1 eth0

ovs-dpctl dump-flows : Use the following to view flow table data.

ovs-appctl

OVS is comprised of several daemons that manage and control an Open vSwitch switch. ovs-appctl is a utility for managing these daemons at runtime. It is useful for configuring log module settings as well as viewing all OpenFlow flows, including hidden ones.

The following are useful commands to use:

ovs-appctl bridge/dump-flows <bridge> : Dumps OpenFlow flows, including hidden flows. Useful for troubleshooting in-band issues.

ovs-appctl dpif/dump-flows <bridge> : Dumps datapath flows for only the specified bridge, regardless of the type.

ovs-appctl vlog/list : Lists the known logging modules and their current levels. Use ovs-appctl vlog/set to set/change the module log level.

ovs-appctl ofproto/trace : Used to show entire flow field of a given flow (flow, matched rule, action taken).

ovs-appctl fdb/show <bridge> : Lists each MAC address/VLAN pair learned by the specified bridge, along with the port on which it was learned and the age of the entry, in seconds.

ovs-appctl fdb/flush <bridge> : Flushes bridge MAC address learning table, or all learning tables if no bridge is given.

ovs-appctl fdb/stats-show <bridge> : Shows MAC address learning table statistics for the specified bridge.

ovs-appctl fdb/stats-clear <bridgegt; : Clears bridge MAC address learning table statistics, or all statistics if no bridge is given.