Neighbours

ovs-ofctl

Also OpenFlow, dump-flows, add-flow, del-flows, flow table, n_packets, dump-ports-desc

Speaks OpenFlow to a switch: lists, adds and removes the flows it forwards by, and shows its ports.

ovs-ofctl is a small OpenFlow client, so it does by hand what a controller does: it connects to the switch (tcp:IP:6653, or the bridge's name on the switch itself) and reads or writes its flow table. Each flow is a match (ip,nw_dst=10.0.1.15, arp,arp_tpa=…, tcp,tp_dst=80, in_port=…) with a priority and actions (output:PORT, drop, CONTROLLER, NORMAL). dump-flows shows each one with n_packets and n_bytes, the packets it matched so far. replace-flows swaps the whole table for a file's, which is how a controller undoes drift.

ovs-ofctl command usage

ovs-ofctl [-O OpenFlow13] [--names] dump-flows SWITCH [MATCH]
ovs-ofctl add-flow SWITCH 'priority=N,MATCH,actions=ACTIONS'
ovs-ofctl del-flows SWITCH [MATCH]
ovs-ofctl replace-flows SWITCH FILE
ovs-ofctl dump-ports-desc SWITCH

Options

-O OpenFlow13: speak OpenFlow 1.3 (the switch must allow it)
--names: show ports by name, not number
tcp:10.0.9.10:6653: the switch to talk to, over the network
priority=100: higher wins when several flows match; 0 is the table-miss flow
actions=output:s3 / drop: send out of that port / discard

ovs-ofctl examples

ovs-ofctl -O OpenFlow13 --names dump-flows tcp:10.0.9.10:6653: Lists s1's flows, with how many packets each matched.
ovs-ofctl -O OpenFlow13 add-flow tcp:10.0.9.11:6653 'priority=200,tcp,tp_dst=80,actions=drop': Drops web traffic at s2, ahead of the forwarding flows.
ovs-ofctl -O OpenFlow13 del-flows tcp:10.0.9.10:6653 icmp: Removes s1's ICMP flows.
ovs-ofctl -O OpenFlow13 dump-ports-desc tcp:10.0.9.10:6653: Lists s1's ports and whether each link is up (LINK_DOWN when not).

Reading the output

$ ovs-ofctl -O OpenFlow13 --names dump-flows tcp:10.0.9.10:6653
 cookie=0x0, duration=12.3s, table=0, n_packets=4, n_bytes=392, priority=100,ip,nw_dst=10.0.1.15 actions=output:s3
 cookie=0x0, duration=12.3s, table=0, n_packets=0, n_bytes=0, priority=0 actions=drop

n_packets climbs with each packet the flow matched: watch it while you ping.
The priority-0 flow catches everything no other flow matched: here, drop.

Pitfalls

A flow added by hand is drift: the controller's next full update removes it.
Without -O OpenFlow13, a switch that allows only 1.3 refuses the connection with a version error.

Run it on real machines