Debugging OVS. Jus.n Pe0t April 14, 2011



Similar documents
OpenStack: OVS Deep Dive

Datacenter Network Virtualization in Multi-Tenant Environments

Underneath OpenStack Quantum: Software Defined Networking with Open vswitch

Troubleshooting for Yamaha router

Creating a Gateway to Gateway VPN between Sidewinder G2 and Linux

netkit lab MPLS VPNs with overlapping address spaces 1.0 S.Filippi, L.Ricci, F.Antonini Version Author(s)

Software Defined Networking (SDN) OpenFlow and OpenStack. Vivek Dasgupta Principal Software Maintenance Engineer Red Hat

Create bridges, add ports, show bridge and port statistics, status, as well as the OVS database

Programmable Networking with Open vswitch

netkit lab two-hosts Università degli Studi Roma Tre Dipartimento di Informatica e Automazione Computer Networks Research Group

IP network tools & troubleshooting. AFCHIX 2010 Nairobi, Kenya October 2010

Open vswitch Configuration Guide

How To Configure Syslog over VPN

How Linux kernel enables MidoNet s overlay networks for virtualized environments. LinuxTag Berlin, May 2014


Linux KVM Virtual Traffic Monitoring

How To Set Up A Network Map In Linux On A Ubuntu 2.5 (Amd64) On A Raspberry Mobi) On An Ubuntu (Amd66) On Ubuntu 4.5 On A Windows Box

SDN/OpenFlow. Dean Pemberton Andy Linton

GregSowell.com. Mikrotik Security

Network Virtualization Tools in Linux PRESENTED BY: QUAMAR NIYAZ & AHMAD JAVAID

Getting to know OpenFlow. Nick Rutherford Mariano Vallés

netkit lab static-routing Università degli Studi Roma Tre Dipartimento di Informatica e Automazione Computer Networks Research Group

Troubleshooting the Firewall Services Module

Configuring Static and Dynamic NAT Simultaneously

Websense Web Security Gateway: What to do when a Web site does not load as expected

MuL SDN Controller HOWTO for pre-packaged VM

Cisco QuickVPN Installation Tips for Windows Operating Systems

Troubleshooting the Firewall Services Module

ovs-vswitchd.conf.db(5) Open vswitch Manual ovs-vswitchd.conf.db(5)

Firewall Troubleshooting

Host Configuration (Linux)

PIX/ASA 7.x with Syslog Configuration Example

OpenFlow Tutorial. January, Version: 4.

Sample Configuration Using the ip nat outside source static

Intel Data Plane Development Kit (Intel DPDK) vswitch

Introduction to Passive Network Traffic Monitoring

tcpdump: network traffic capture

Troubleshooting Procedures for Cisco TelePresence Video Communication Server

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

Understanding and Configuring NAT Tech Note PAN-OS 4.1

Multicasting on SDN. Prof. Sunyoung Han Konkuk University 23 July 2015

Network Administration and Monitoring

Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort

OVN: Open Virtual Network for Open vswitch. Ben Pfaff Justin Pettit

Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1

Packet Monitor in SonicOS 5.8

20 Command Line Tools to Monitor Linux Performance

Enabling NetFlow on Virtual Switches ESX Server 3.5

Using OpenFlow 1.3 RYU. SDN Framework. RYU project team

Project 2: Firewall Design (Phase I)

Red Hat Linux Networking

Danger of Proxy ARP in IX environment version 0.3. Maksym Tulyuk

SSL Tunnels. Introduction

Sample Configuration Using the ip nat outside source list C

TECHNICAL NOTE. Technical Note P/N REV 03. EMC NetWorker Simplifying firewall port requirements with NSR tunnel Release 8.

OpenFlow with Intel Voravit Tanyingyong, Markus Hidell, Peter Sjödin

isco Troubleshooting Input Queue Drops and Output Queue D

Forensic Network Analysis Tools

Netflow Collection with AlienVault Alienvault 2013


NAS 272 Using Your NAS as a Syslog Server

Packet Capture. Document Scope. SonicOS Enhanced Packet Capture

Lab Configure Intrusion Prevention on the PIX Security Appliance

How to set up multiple web servers (VMs) on XenServer reusing host's static IP

Magnum Network Software DX

Migrating the SSL Offloading Configuration of the Alteon Application Switch 2424-SSL to AlteonOS version

Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1

Quick Note 041. Digi TransPort to Digi TransPort VPN Tunnel using OpenSSL certificates.

MINI-FAQ: OpenBSD 2.4 IPSEC VPN Configuration

Cloud Networking Disruption with Software Defined Network Virtualization. Ali Khayam

Release Notes for Epilog for Windows Release Notes for Epilog for Windows v1.7/v1.8

Netfilter / IPtables

Deploy the ExtraHop Discover Appliance on a Linux KVM

Quick Note 20. Configuring a GRE tunnel over an IPSec tunnel and using BGP to propagate routing information. (GRE over IPSec with BGP)

LECTURE 4 NETWORK INFRASTRUCTURE

Linux Virtual Server Tutorial

Lab Exercise SSL/TLS. Objective. Requirements. Step 1: Capture a Trace

Cisco Local Director Abstract. Stephen Gill Revision: 1.0, 04/18/2001

7750 SR OS System Management Guide

OpenDaylight and OpFlex. Scott Mann

Java Secure Application Manager

SIDN Server Measurements

FortiOS Handbook - Load Balancing VERSION 5.2.2

Hardening MySQL. Maciej Dobrzański maciek at

GregSowell.com. Mikrotik Basics

Lab 5.5 Configuring Logging

Quick Note 051. Common Passwords/ID errors in IPsec VPN negotiation for TransPort routers. DRAFT July 2015

OVN: Open Virtual Network for Open vswitch. Russell Bryant Kyle Mestery Justin Pettit

Linksys RV042. TheGreenBow IPSec VPN Client. Configuration Guide.

Guideline for setting up a functional VPN

Linux Network Security

A Research Study on Packet Sniffing Tool TCPDUMP

Configure ISE Version 1.4 Posture with Microsoft WSUS

Cisco Which VPN Solution is Right for You?

How To Learn Cisco Cisco Ios And Cisco Vlan

HONEYD (OPEN SOURCE HONEYPOT SOFTWARE)

Software Defined Networking (SDN) - Open Flow

Programming Assignments for Graduate Students using GENI Flow Management using OpenFlow on GENI

Transcription:

Debugging OVS Jus.n Pe0t April 14, 2011

Main Components Control Cluster Off- box ovsdb- server ovs- vswitchd User Kernel Management Protocol (6632/TCP) OpenFlow (6633/TCP) Netlink openvswitch_mod.ko

Debugging the Database ovs- vsctl: Configures ovs- vswitchd, but really a high- level interface for database ovs- vsctl list- br ovs- vsctl list- ports <bridge> ovs- vsctl get- manager <bridge> ovs- vsctl get- controller <bridge> ovs- vsctl list <table> ovsdb- tool: Command- line tool for managing database file ovsdb- tool show- log [- mmm] <file>

Core Tables Open_vSwitch SSL Manager Bridge Controller Port Interface Open_vSwitch is the root table and there is always only a single row. The tables here are the ones most commonly used; a full en.ty- rela.onship diagram is available in the ovs- vswitchd.conf.db man page.

ovsdb- tool show- log Record number Time of Change Caller s comment [root@localhost ~]# ovsdb-tool show-log -m /etc/openvswitch/conf.db!...! record 3: 2011-04-13 16:03:52 "ovs-vsctl: /usr/bin/ovs-vsctl --timeout=20 -- --with-iface --if-exists del-port eth0 -- --may-exist add-br xenbr0 -- -- may-exist add-port xenbr0 eth0 -- set Bridge xenbr0 "other-config:hwaddr= \"00:0c:29:ab:f1:e9\"" -- set Bridge xenbr0 fail_mode=standalone -- remove Bridge xenbr0 other_config disable-in-band -- br-set-external-id xenbr0 xsnetwork-uuids 9ae8bc91-cfb8-b873-1947-b9c4098e4f4b"!!table Port insert row "xenbr0":!!table Port insert row "eth0":!!table Interface insert row "eth0":!!table Interface insert row "xenbr0":!!table Open_vSwitch row a1863ada:!!table Bridge insert row "xenbr0":!...! Database changes

OpenFlow ovs- ofctl speaks to OpenFlow module ovs- ofctl dump- flows <bridge> ovs- ofctl snoop <bridge> OpenFlow 1.0 plus extensions Resubmit Ac.on: Simulate mul.ple tables in a single table NXM: Extensible match Registers: Four 32- bit metadata registers See hidden flows (in- band, fail- open, etc): ovs- appctl bridge/dump- flows <bridge>

Connec.vity to Control Cluster State of connec.on tracked in database ovs- vsctl list controller ovs- vsctl list manager status column may contain the following members: state: ACTIVE indicates that connec.on is good sec_since_connect sec_since_disconnect last_error

Kernel Datapath ovs- dpctl speaks to kernel module See datapaths and their ahached interfaces: ovs- dpctl show [bridge] Exact match flows cached in datapath: ovs- dpctl dump- flows <bridge>

ovs- dpctl show hit: Packets hit exis.ng entry missed: Packets sent to userspace [root@localhost ~]# ovs-dpctl show br0! system@br0:!!lookups: frags:0, hit:5486, missed:4381, lost:0!!port 0: pool (internal)!!port 1: p11 (patch: peer=pl0)! lost: Dropped before ge0ng to userspace!port 2: p13 (patch: peer=pl2)!!port 3: sgre_3d000002 (ipsec_gre: csum=true, key=flow, pmtud=false, remote_ip=61.0.0.2)!!port 4: gre_33000002 (gre: key=flow, remote_ip=51.0.0.2)!!port 5: gre_33000003 (gre: key=flow, remote_ip=51.0.0.3)! Interface name Interface type Interface op.ons (OpenFlow) Port number

Tunnels Tunnels in OVS are just virtual ports with own OpenFlow port number Keys set sta.cally at crea.on.me or dynamically through OpenFlow ac.on Types: GRE GRE- over- IPsec CAPWAP Visible in kernel datapath: ovs- dpctl show

IPsec Tunnels ovs- monitor- ipsec monitors database for changes and updates IPsec configura.on racoon handles key nego.a.on (IKE) setkey configures security kernel databases SPD (Security Policy Database) determines when traffic should be encrypted Dump SPD: setkey - DP Flush SPD: setkey - FP SAD (Security Associa.on Database) contains state for ac.ve flows Dump SAD: setkey - D Flush SAD: setkey - F

IPsec Components Control Cluster Off- box racoon ovs- monitor- ipsec ovsdb- server ovs- vswitchd setkey User Kernel SPD SAD openvswitch_mod.ko

IPsec Traffic Analysis Encrypted traffic on the PIF root@squeeze-2:~# tcpdump -ni eth0! tcpdump: verbose output suppressed, use -v or -vv for full protocol decode! listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes! 12:36:45.974167 IP 172.16.5.57 > 172.16.3.79: ESP(spi=0x0baaab15,seq=0x33), length 124! 12:36:45.974249 IP 172.16.3.79 > 172.16.5.57: ESP(spi=0x014d5d92,seq=0x35), length 124! Decrypted traffic on the bridge root@squeeze-2:~# tcpdump -ni br0! tcpdump: verbose output suppressed, use -v or -vv for full protocol decode! listening on br0, link-type EN10MB (Ethernet), capture size 65535 bytes! 12:36:54.971521 IP 12.0.0.1 > 12.0.0.2: ICMP echo request, id 28173, seq 50, length 64! 12:36:54.971536 IP 12.0.0.2 > 12.0.0.1: ICMP echo reply, id 28173, seq 50, length 64!

XenServer Is it running? An upgrade doesn t necessarily enable OVS: service openvswitch status Enable OVS: xe- switch- network- backend openvswitch Disable OVS: xe- switch- network- backend bridge

Logging ovs- appctl configures running OVS daemons Most common use is to modify logging levels By default configures ovs- vswitchd, but - t op.on changes target Default level for log files is info, only thing lower is dbg [root@localhost ~]# ovs-appctl vlog/list! console syslog file! ------- ------ ------! bridge EMER ERR INFO! vswitchd EMER ERR INFO!...! [root@localhost ~]# ovs-appctl vlog/set ofproto:file:dbg!

Log Files Open vswitch logs: /var/log/openvswitch/* ovs- vswitchd.log ovsdb- server.log System: /var/log/messages IPsec: /var/log/daemon.log

Debugging Tips Test basic connec.vity Remote side up? STP learning state? Use tcpdump to see if expected packets are on the wire Try it without OVS

Catastrophe! Bug details: What were you doing when it happened? OVS build number OS version Collect logs and system state to aid debugging: XenServer: xen- bugtool Debian: ovs- bugtool Core dump Check the version number, it may be old: strings <core> grep version Kernel Panic Take picture of screen may be easiest

Final Thought Read the documenta.on it s prehy good!