A flow is one rule in a switch
An OpenFlow flow is one rule in a switch's flow table. It is made of a match, a priority and an action.
Reading flows is how an engineer finds out why a packet went missing. By the end you can say which rule a packet meets, and why.
By the end of this lesson
Note
I can read a flow and say what its match, priority and action are.
Key words
| Word | What it means | Example |
|---|---|---|
| Flow | one rule in a switch's flow table | |
| Match | the part of a flow that says which packets it is for | in_port=1 |
| Priority | a number: the higher one wins | |
| Action | what the switch does with a matching packet | output:3 |
| Table-miss flow | the flow with priority 0 that matches every packet | |
| Trace | asking a switch which flow a made-up packet would meet |
The cells students fill in are left blank in this preview.
A flow has a match, priority and action
The match says which packets the flow is for: the port it came in on, the kind of packet, an address. The priority says how important the flow is. The action says what to do: send it out of a port, or drop it.
Open vSwitch prints a flow as priority=10,in_port=1 actions=output:3.
Worked example: three flows, read aloud
| Flow | In words |
|---|---|
| priority=100,tcp,tp_dst=23 actions=drop | A TCP packet for port 23 (telnet, an old remote login) is dropped |
| priority=10,in_port=1 actions=output:3 | Anything that came in on port 1 goes out of port 3 |
| priority=0 actions=drop | Anything else is dropped |
The cells students fill in are left blank in this preview.
The highest priority flow that matches wins
More than one flow can match a packet. The switch picks the one with the highest priority and does only its action.
A flow with priority 0 and no match at all matches every packet. It is the table-miss flow, the last resort. With no table-miss flow, a packet that matches nothing is dropped.
Worked example: which flow does each packet meet?
| Packet | Flows it matches | Winner | Action |
|---|---|---|---|
| TCP, port 23, in on port 1 | priority 100, 10, 0 | 100 | drop |
| TCP, port 80, in on port 1 | priority 10, 0 | 10 | output:3 |
| TCP, port 80, in on port 2 | priority 0 | 0 | drop |
| UDP, port 23, in on port 1 | priority 10, 0 | 10 | output:3 |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think the flow listed first wins, like the first rule in a list. The priority decides, not the position. A flow listed last wins if its priority is the highest. Use priority to put the specific rules above the general ones.
Trace packets through a flow table
Open vSwitch can trace a made-up packet through its flow table and tell you which flow it met. Nothing is sent. It is the safest way to test rules.
You will type three flows by hand, then trace four packets. Flows typed by hand are lost the next time the lab is rebuilt, and your own flows file is not touched. Each trace prints two lines: the flow that matched and its action.
Rebuild the lab with no controller
sudo sdnlab flowsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Empty the flow table
sudo ovs-ofctl -O OpenFlow13 del-flows br0Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace a packet through an empty table
sudo ovs-appctl ofproto/trace br0 in_port=1,tcp,tp_dst=23 | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Type three flows by hand
printf 'priority=0,actions=drop\npriority=10,in_port=1,actions=output:3\npriority=100,tcp,tp_dst=23,actions=drop\n' | sudo ovs-ofctl -O OpenFlow13 add-flows br0 -Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
List the flows
sudo ovs-ofctl -O OpenFlow13 dump-flows br0 --no-statsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace telnet in on port 1
sudo ovs-appctl ofproto/trace br0 in_port=1,tcp,tp_dst=23 | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace web traffic in on port 1
sudo ovs-appctl ofproto/trace br0 in_port=1,tcp,tp_dst=80 | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace web traffic in on port 2
sudo ovs-appctl ofproto/trace br0 in_port=2,tcp,tp_dst=80 | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace a UDP packet for port 23
sudo ovs-appctl ofproto/trace br0 in_port=1,udp,udp_dst=23 | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The same answers as the worked example
With an empty table the trace said No match and drop, which is what a switch with no flows does.
With the three flows it matched what the worked example said. Telnet met priority 100. Web traffic from port 1 met priority 10 and went out of port 3. Web traffic from port 2 fell to priority 0. The UDP packet was not caught by the telnet flow, because that flow names TCP.
Add a flow for every IP packet
sudo ovs-ofctl -O OpenFlow13 add-flow br0 priority=20,ip,actions=dropShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Trace an ARP packet in on port 1
sudo ovs-appctl ofproto/trace br0 in_port=1,arp | grep -A1 "^ 0\."Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A match names the kind of packet
The new flow has priority 20, above the port 1 flow, yet the ARP packet still met priority 10. ARP is how a computer asks "who has this IP address?", and ip does not cover it.
A flow only catches the kind of packet it names. Run sudo sdnlab flows to put the lab back.