netdev - Re: openvswitch question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 20 Mar 2014 09:29:25 -0700
From:	Jesse Gross <jesse@...ira.com>
To:	sowmini varadhan <sowmini05@...il.com>
Cc:	ratheesh kannoth <ratheesh.ksz@...il.com>,
	netdev <netdev@...r.kernel.org>
Subject: Re: openvswitch question

On Thu, Mar 20, 2014 at 3:26 AM, sowmini varadhan <sowmini05@...il.com> wrote:
> On Wed, Mar 19, 2014 at 9:36 PM, Jesse Gross <jesse@...ira.com> wrote:
> evel/19402
>>
>> From the perspective of the network stack, there is no difference
>> between Open vSwitch internal devices and real NICs so the entry
>> points into the stack are the same.
>
> However, the internal vswitch ports like patch-tun and patch-int
> are not standard net_devices, so they cannot, e.g.,  be tcpdump'ed,
> correct?

Patch ports exist only in userspace in order to avoid multiple
redundant lookups, so, yes, they cannot be tcpdumped.

> FWIW, I've already raised an issue with tcpdump/ovswitch mirroring
>  in the openstack-dev list, but repeat
> it here, in the hope that someone can shed some light on what
> I need to make this work. I'm using a ubuntu 13.10 qemu-kvm
> where I'm running openvswitch 1.10.2.
>
> " I'm following the instructions at
>   http://docs.openstack.org/trunk/openstack-ops/content/network_troubleshooting.html
>
>   to set up patch-tun mirrors, but running tcpdump on the "snooper0"
>   produces inconsistent results- sometimes, I'm able to get a copy
>   of the packet (e.g., the syn packet for ssh below) but not others
>   (the tcpdump session did not show any more packets, for example).
>
>   Why is this?

Mirroring should work. You would have to look at the packets entering
the switch and then trying to look at the flows (using ovs-dpctl
dump-flows and ovs-appctl ofproto/trace) to figure out what is
different.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html