2

I have a system with arch linux running OVS. I also have a controller running in the same box. I have the following setup:-

ovs-vsctl set-controller br-int tcp:192.168.1.201:6633

I was hoping to use tshark( tshark 2.2.8) to capture the openflow using the following command:-

 sudo tshark -i br-int -d tcp.port==6633,openflow -O openflow_v4

it dumps all the all the flows that is flowing in the system but no packetIn openflow messages. I did confirm packetIn message was received by the controller. ( pasting the last few lines:-)

EVENT ofp_event->EventOFPPacketIn
packet in 1237689849893337 b8:27:xx:xx:yy:yy:zz ff:ff:ff:ff:ff:ff:3

I also understand from the tshark document that by default it uses the port 6653 for openflow.

  tshark -G decodes | grep -i openflow
  tcp.port        6653    openflow

However I was in the impression that I can still look for openflow traffic by using the following capture command:-

https://wiki.wireshark.org/OpenFlow

 tshark tcp port 6633

This also doesn't work as no events are captured though I can see the controller receiving lots of events..

would greatly appreciate any help here.

sunny
  • 643
  • 2
  • 11
  • 29

1 Answers1

2

My guess would be that you're not listening on the correct interface. Try the following:

sudo tshark -i any -d tcp.port==6633,openflow -O openflow_v4

If that doesn't work, it's possible your controller and switch are not communicating using OpenFlow 1.3. To make sure you see everything, try:

sudo tshark -i any -d tcp.port==6633

Details. Unless there's something particular in your setup, packets from Open vSwitch to the controller and back do not go through the bridge. Since both ends of the communication are on the same host, packets are probably going through the loopback interface:

sudo tshark -i lo -d tcp.port==6633

I was able to reproduce your setup and issue to confirm my answer with Open vSwitch 2.5.2 and Floodlight (master branch). I can see packets passing through on the loopback interface with both tcpdump and tshark.

pchaigno
  • 11,313
  • 2
  • 29
  • 54
  • let me give it a try and get back. I didn't know about this. However I did confirm that i was using openflow 1.3 as the above commands worked when I tried to connect it to a controller on a different server. appreciate your help. i will close this once I give it a shot. – sunny Aug 19 '17 at 18:42
  • the interface any worked but lo did not. but thank you - atleast I am moving forward. I have a related question which I will ask as a separate question. – sunny Aug 22 '17 at 05:55
  • Weird, it was going through lo for me. Are you under Linux? Were you able to identify the interface from which it leaves? – pchaigno Aug 22 '17 at 06:05
  • it is arch Linux - not sure if that makes it any different. Also, the above tshark commands captures all the flows not just openflow. why is that ?. i thought we had given a capture filter "-d tcp.port==6633,openflow -O openflow_v4"?. shouldn't it only look for openflow. – sunny Aug 22 '17 at 19:16
  • It will capture all traffic going to or coming from port 6633. From what I remember, some of it may appear as plain TCP packets. – pchaigno Aug 22 '17 at 20:31