OpenFlow 命令

OpenFlow 命令

創建一個OVS交換機

1. ovs-vsctl add-br ovs-switch

複製代碼

創建一個端口 p0，設置端口 p0 的 OpenFlow 端口編號爲 100

1. ovs-vsctl add-port ovs-switch p0 -- set Interface p0 ofport_request=100

複製代碼

設置網絡接口設備類型爲”internal”,

1. ovs-vsctl set Interface p0 type=internal

複製代碼

查看設置結果

1. ethtool -i p0

複製代碼

1. driver: openvswitch
   
2. version: 
   
3. firmware-version: 
   
4. bus-info: 
   
5. supports-statistics: no
   
6. supports-test: no
   
7. supports-eeprom-access: no
   
8. supports-register-dump: no
   
9. supports-priv-flags: no

複製代碼

 

創建一個name space：ns0，把p0端口接入到ns0裏，並且配置ip地址 192.168.1.100/24

1. ip netns add ns0
   
2. ip link set p0 netns ns0
   
3. ip netns exec ns0 ip addr add 192.168.1.100/24 dev p0
   
4. ip netns exec ns0 ifconfig p0 promisc up

複製代碼

查看創建結果

1. ovs-vsctl show
   
2. 6507c214-0c7a-4159-9813-977074f73aa1
   
3.     Bridge ovs-switch
   
4.         Port "p0"
   
5.             Interface "p0"
   
6.                 type: internal
   
7.         Port ovs-switch
   
8.             Interface ovs-switch
   
9.                 type: internal
   
10.     ovs_version: "2.0.2"

複製代碼

重複步驟，創建p1和p2端口

1. ovs-vsctl add-port ovs-switch p1 -- set Interface p1 ofport_request=101
   
2. ovs-vsctl set Interface p1 type=internal
   
3. ip netns add ns1
   
4. ip link set p1 netns ns1
   
5. ip netns exec ns1 ip addr add 192.168.1.101/24 dev p1
   
6. ip netns exec ns1 ifconfig p1 promisc up

複製代碼

查看創建結果

ovs-vsctl show
c402802a-dbe0-4127-9bce-e2405a4ac33d
    Bridge ovs-switch
        Port "p0"
            Interface "p0"
                type: internal
        Port ovs-switch
            Interface ovs-switch
                type: internal
        Port "p1"
            Interface "p1"
                type: internal
    ovs_version: "2.0.2"


 


創建p2

1. ovs-vsctl add-port ovs-switch p2 -- set Interface p2 ofport_request=102
   
2. ovs-vsctl set Interface p2 type=internal
   
3. ip netns add ns2
   
4. ip link set p2 netns ns2
   
5. ip netns exec ns2 ip addr add 192.168.1.102/24 dev p2
   
6. ip netns exec ns2 ifconfig p2 promisc up

複製代碼

c402802a-dbe0-4127-9bce-e2405a4ac33d
    Bridge ovs-switch
        Port "p0"
            Interface "p0"
                type: internal
        Port "p2"
            Interface "p2"
                type: internal
        Port ovs-switch
            Interface ovs-switch
                type: internal
        Port "p1"
            Interface "p1"
                type: internal
    ovs_version: "2.0.2"



查看創建的交換機信息，獲得dpid，端口openflow端口編號

1. ovs-ofctl show ovs-switch

複製代碼

1. OFPT_FEATURES_REPLY (xid=0x2): dpid:0000c6d6454c204e
   
2. n_tables:254, n_buffers:256
   
3. capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
   
4. actions: OUTPUT SET_VLAN_VID SET_VLAN_PCP STRIP_VLAN SET_DL_SRC SET_DL_DST SET_NW_SRC SET_NW_DST SET_NW_TOS SET_TP_SRC SET_TP_DST ENQUEUE
   
5. 100(p0): addr:00:00:00:00:00:00
   
6.      config:     PORT_DOWN
   
7.      state:      LINK_DOWN
   
8.      speed: 0 Mbps now, 0 Mbps max
   
9. 101(p1): addr:00:00:00:00:00:00
   
10.      config:     PORT_DOWN
    
11.      state:      LINK_DOWN
    
12.      speed: 0 Mbps now, 0 Mbps max
    
13. 102(p2): addr:00:00:00:00:00:00
    
14.      config:     PORT_DOWN
    
15.      state:      LINK_DOWN
    
16.      speed: 0 Mbps now, 0 Mbps max
    
17. LOCAL(ovs-switch): addr:76:f1:e5:e8:19:ed
    
18.      config:     PORT_DOWN
    
19.      state:      LINK_DOWN
    
20.      speed: 0 Mbps now, 0 Mbps max
    
21. OFPT_GET_CONFIG_REPLY (xid=0x4): frags=normal miss_send_len=0

複製代碼

獲取openflow端口編號

1. ovs-vsctl get Interface p0 ofport

複製代碼

100

1. ovs-vsctl get Interface p1 ofport

複製代碼

101

1. ovs-vsctl get Interface p2 ofport

複製代碼

102


查看 datapath 的信息

1. ovs-dpctl show

複製代碼

1. system@ovs-system:
   
2.         lookups: hit:35 missed:21 lost:0
   
3.         flows: 0
   
4.         port 0: ovs-system (internal)
   
5.         port 1: ovs-switch (internal)
   
6.         port 2: p0 (internal)
   
7.         port 3: p1 (internal)
   
8.         port 4: p2 (internal)

複製代碼

 


查看mac地址

1. ip netns exec ns0 ping 192.168.1.100
   
2. ip netns exec ns0 ping 192.168.1.101
   
3. ip netns exec ns0 ping 192.168.1.102

複製代碼

這裏100ping不同，原因不明

然後運行

1. ovs-appctl fdb/show ovs-switch

複製代碼

1. port  VLAN  MAC                Age
   
2.   101     0  1a:19:57:65:03:f2   55
   
3.   102     0  36:54:7a:1c:c9:43   48
   
4.   100     0  36:92:12:98:4d:40   48

複製代碼

查看交換機所有table

1. ovs-ofctl dump-tables ovs-switch

複製代碼

 

253個table.

查看交換機中的所有流表項

1. ovs−ofctl dump−flows ovs-switch

複製代碼

輸出如下信息：

1. cookie=0x0, duration=1756.751s, table=0, n_packets=96, n_bytes=7784, idle_age=303, priority=0 actions=NORMAL

複製代碼

刪除編號爲 100 的端口上的所有流表項

1. ovs-ofctl del-flows ovs-switch "in_port=100"

複製代碼

查看交換機端口信息

1. ovs-ofctl show ovs-switch

複製代碼

修改數據包

屏蔽所有進入 OVS 的以太網廣播數據包

1. ovs-ofctl add-flow ovs-switch "table=0, dl_src=01:00:00:00:00:00/01:00:00:00:00:00, actions=drop"

複製代碼

屏蔽 STP 協議的廣播數據包

1. ovs-ofctl add-flow ovs-switch "table=0, dl_dst=01:80:c2:00:00:00/ff:ff:ff:ff:ff:f0, actions=drop"

複製代碼

修改數據包，添加新的 OpenFlow 條目，修改從端口 p0 收到的數據包的源地址爲 9.181.137.1

1. ovs-ofctl add-flow ovs-switch "priority=1 idle_timeout=0,\
   
2.     in_port=100,actions=mod_nw_src:9.181.137.1,normal"

複製代碼

從端口 p0（192.168.1.100）發送測試數據到端口 p1（192.168.1.101），就是沒啥響應

1. ip netns exec ns0 ping 192.168.1.101

複製代碼

再打開一個ssh終端，登錄進去，運行tcpdump，需要等待幾分鐘，才能看到響應

1. ip netns exec ns1 tcpdump -i p1 icmp

複製代碼

1. ip netns exec ns1 tcpdump -i p1 icmp
   
2. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   
3. listening on p1, link-type EN10MB (Ethernet), capture size 65535 bytes
   
4. 02:40:20.212575 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 89, length 64
   
5. 02:40:21.220600 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 90, length 64
   
6. 02:40:22.228630 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 91, length 64
   
7. 02:40:23.236670 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 92, length 64
   
8. 02:40:24.244721 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 93, length 64
   
9. 02:40:25.252758 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 94, length 64
   
10. 02:40:26.260777 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 95, length 64
    
11. 02:40:27.268868 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 96, length 64
    
12. 02:40:28.276857 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 97, length 64
    
13. 02:40:29.284839 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 98, length 64
    
14. 02:40:30.292939 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 99, length 64
    
15. 02:40:31.300987 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 100, length 64
    
16. 02:40:32.308972 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 101, length 64
    
17. 02:40:33.317053 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 102, length 64
    
18. 02:40:34.325103 IP 9.181.137.1 > 192.168.1.101: ICMP echo request, id 2118, seq 103, length 64

複製代碼

重定向數據包

添加新的 OpenFlow 條目，重定向所有的 ICMP 數據包到端口 p2

1. ovs-ofctl add-flow ovs-switch idle_timeout=0,dl_type=0x0800,nw_proto=1,actions=output:102

複製代碼

從端口 p0 （192.168.1.100）發送數據到端口 p1（192.168.1.101）

這個時候你從p2裏，可以看到

1. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   
2. listening on p2, link-type EN10MB (Ethernet), capture size 65535 bytes
   
3. 06:25:38.252471 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 35, length 64
   
4. 06:25:39.260438 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 36, length 64
   
5. 06:25:40.268419 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 4668, seq 37, length 64

複製代碼

修改vlan tag

修改端口 p1 的 VLAN tag 爲 101，使端口 p1 成爲一個隸屬於 VLAN 101 的端口

1. ovs-vsctl set Port p1 tag=101

複製代碼

現在由於端口 p0 和 p1 屬於不同的 VLAN，它們之間無法進行數據交換。我們使用 ovs-appctl ofproto/trace 生成一個從端口 p0 發送到端口 p1 的數據包，這個數據包不包含任何 VLAN tag，並觀察 OVS 的處理過程

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. dl_dst=f2:0d:06:ff:79:d7 -generate

複製代碼

注意：上面第一個mac地址，是p0的，第二個mac地址是p1的，你需要替換，上面有獲取mac地址的方法。

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. > dl_dst=f2:0d:06:ff:79:d7 -generate
   
3. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=1,in_port=100
   
5. OpenFlow actions=mod_nw_src:9.181.137.1,NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000/0x1fff,dl_src=d6:0f:7e:ed:11:e4,
   
10. dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_src=0.0.0.0,nw_proto=0,nw_frag=no
    
11. Datapath actions: 1,4

複製代碼

在第一行輸出中，“Flow:”之後的字段描述了輸入的流的信息。由於我們沒有指定太多信息，所以多數字段 （例如 dl_type 和 vlan_tci）被 OVS 設置爲空值。

在第二行的輸出中，“Rule:” 之後的字段描述了匹配成功的流表項。

在第三行的輸出中，“OpenFlow actions”之後的字段描述了實際執行的操作。

最後一段以”Final flow”開始的字段是整個處理過程的總結，“Datapath actions: 4,1”代表數據包被髮送到 datapath 的 4 和 1 號端口。

創建一條新的 Flow

對於從端口 p0 進入交換機的數據包，如果它不包含任何 VLAN tag，則自動爲它添加 VLAN tag 101

1. ovs-ofctl add-flow ovs-switch "priority=3,in_port=100,dl_vlan=0xffff,\
   
2. actions=mod_vlan_vid:101,normal"

複製代碼

再次嘗試從端口 p0 發送一個不包含任何 VLAN tag 的數據包，發現數據包進入端口 p0 之後, 會被加上 VLAN tag101, 同時轉發到端口 p1 上

1. ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
   
2. > dl_dst=f2:0d:06:ff:79:d7 -generate
   
3. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=1,in_port=100
   
5. OpenFlow actions=mod_nw_src:9.181.137.1,NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000/0x1fff,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_src=0.0.0.0,nw_proto=0,nw_frag=no
   
10. Datapath actions: 1,4
    
11. root@ovs:~# ovs-ofctl add-flow ovs-switch "priority=3,in_port=100,dl_vlan=0xffff,\
    
12. > actions=mod_vlan_vid:101,normal"
    
13. root@ovs:~# ovs-appctl ofproto/trace ovs-switch in_port=100,dl_src=d6:0f:7e:ed:11:e4,\
    
14. > dl_dst=f2:0d:06:ff:79:d7 -generate
    
15. Flow: metadata=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
    
16. Rule: table=0 cookie=0 priority=3,in_port=100,vlan_tci=0x0000
    
17. OpenFlow actions=mod_vlan_vid:101,NORMAL
    
18. no learned MAC for destination, flooding
    
19. 
    
20. Final flow: metadata=0,in_port=100,dl_vlan=101,dl_vlan_pcp=0,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000
    
21. Relevant fields: skb_priority=0,in_port=100,vlan_tci=0x0000,dl_src=d6:0f:7e:ed:11:e4,dl_dst=f2:0d:06:ff:79:d7,dl_type=0x0000,nw_proto=0,nw_frag=no
    
22. Datapath actions: push_vlan(vid=101,pcp=0),1,pop_vlan,3,push_vlan(vid=101,pcp=0),4

複製代碼

反過來從端口 p1 發送數據包，由於 p1 現在是帶有 VLAN tag 101 的 Access 類型的端口，所以數據包進入端口 p1 之後，會被 OVS 添加 VLAN tag 101 併發送到端口 p0

1. ovs-appctl ofproto/trace ovs-switch in_port=101,dl_src=f2:0d:06:ff:79:d7,\
   
2. > dl_dst=d6:0f:7e:ed:11:e4 -generate
   
3. Flow: metadata=0,in_port=101,vlan_tci=0x0000,dl_src=f2:0d:06:ff:79:d7,dl_dst=d6:0f:7e:ed:11:e4,dl_type=0x0000
   
4. Rule: table=0 cookie=0 priority=0
   
5. OpenFlow actions=NORMAL
   
6. no learned MAC for destination, flooding
   
7. 
   
8. Final flow: unchanged
   
9. Relevant fields: skb_priority=0,in_port=101,vlan_tci=0x0000,dl_src=f2:0d:06:ff:79:d7,dl_dst=d6:0f:7e:ed:11:e4,dl_type=0x0000,nw_proto=0,nw_frag=no
   
10. Datapath actions: push_vlan(vid=101,pcp=0),1,2,4

複製代碼