ovs-vsctl

Open vSwitch keeps its configuration in a small database (ovsdb-server) and forwards in the kernel (ovs-vswitchd programs it). ovs-vsctl edits that database: add-br makes a bridge, add-port puts a card in it, set-controller says where its OpenFlow controller is (tcp:IP:6653 to connect out, ptcp:6653 to wait for one), and set-fail-mode what to do without one: secure forwards only by the flows it has, standalone learns like an ordinary switch. ovs-vsctl show prints it all, with is_connected: true under a controller that is connected.

ovs-vsctl command usage

ovs-vsctl show
ovs-vsctl add-br BRIDGE
ovs-vsctl add-port BRIDGE PORT
ovs-vsctl set-controller BRIDGE TARGET
ovs-vsctl set-fail-mode BRIDGE secure|standalone
ovs-vsctl list-ports BRIDGE

Options

show

every bridge with its ports, controller and fail mode

set-controller br0 tcp:10.0.9.13:6653

connect to that controller (ptcp:6653: wait for it to connect)

set-fail-mode br0 secure

never forward by itself: only by the flows it holds

--may-exist / --if-exists

do nothing instead of failing when it is already there, or already gone

ovs-vsctl examples

ovs-vsctl show

Shows the switch's bridge, its ports, the controller target and the fail mode.

ovs-vsctl list-ports br0

Lists the ports of br0.

ovs-vsctl get-fail-mode br0

Prints secure or standalone.

Reading the output

$ ovs-vsctl show
    Bridge br0
        Controller "ptcp:6653"
        fail_mode: secure
        Port alice
            Interface alice
        Port s2
            Interface s2

• fail_mode: secure: with no flows, nothing is forwarded.
• Each Port is a card in the bridge, named after the device at its other end.

Pitfalls

• A secure switch with no flows drops everything, ARP included: it is not broken, it is waiting for its controller.
• ovs-vsctl changes the configuration, not the flow table: flows are ovs-ofctl's.

Run it on real machines