測試FlowTable

1.肯定openvswitch模塊加載
#lsmod |grep oepnvswitch
#/sbin/modprobe openvswitch

2.啓動配置:
1）默認配置
rm -f /usr/local/etc/openvswitch/conf.db
ovsdb-tool create /usr/local/etc/openvswitch/conf.db /usr/local/share/openvswitch/vswitch.ovsschema

ovsdb-server -v --remote=punix:/usr/local/var/run/openvswitch/db.sock --remote=db:Open_vSwitch,Open_vSwitch,manager_options --private-key=db:Open_vSwitch,SSL,private_key --certificate=db:Open_vSwitch,SSL,certificate --bootstrap-ca-cert=db:Open_vSwitch,SSL,ca_cert --log-file --pidfile --detach

ovs-vswitchd --log-file --pidfile --detach

注：-vINFO」表示日誌級別，共有emer、err、warn、info、dbg ;-v默認不帶是dbg級別。

 

2）自定義路徑
rm /etc/openvswitch/*.db
ovsdb-tool create /etc/openvswitch/ovs.db /usr/local/share/openvswitch/vswitch.ovsschema
ovsdb-tool create /etc/openvswitch/vtep.db /usr/local/share/openvswitch/vtep.ovsschema

ovsdb-server --pidfile --detach --log-file --remote punix:/usr/local/var/run/openvswitch/db.sock --remote=db:hardware_vtep,Global,managers --remote ptcp:9999 /etc/openvswitch/ovs.db /etc/openvswitch/vtep.db

ovs-vswitchd --log-file --detach --pidfile unix:/usr/local/var/run/openvswitch/db.sock

LOG： /usr/local/var/log/openvswitch/ovsdb-server.log

3.操做配置
ovs-vsctl add-br br0
ovs-vsctl set-controller br0 tcp:172.16.26.136:6653

經過ovs 建立一個br0,  端口tap0 ,tap1,tap2對應 值爲100, 101,102；建立虛擬網絡空間ns0,ns1,ns2,建立虛擬網卡veth0,veth1, veth2,對應ip地址爲192.168.1.100,192.168.1.101,192.168.1.102;tap0-veth0,tap1-veth1,tap2-veth2橋接。

 

 

1.建立虛擬交換機

#ovs-vsctl add-br br0

 

2.建立網絡空間ns0, 虛擬網卡veth0 和 peer tap0

#ip netns add ns0

#ip link add veth0 type veth peer name tap0

#ip link set veth0 netns ns0

#ip netns exec ns0 ip link set dev veth0 up

#ip netns exec ns0 ip addr add 192.168.1.100/24 dev veth0

#ip link set dev tap0 up

 

#ovs-vsctl add-port br0 tap0

#ovs-vsctl set Interface tap0 ofport_request=100

 

 3.建立網絡空間ns1 虛擬網卡veth1 和 peer tap1

ip netns add ns1

#ip link add veth1 type veth peer name tap1

#ip link set veth1 netns ns1

#ip netns exec ns1 ip link set dev veth1 up

#ip netns exec ns1 ip addr add 192.168.1.101/24 dev veth1

#ip link set dev tap1 up

 

#ovs-vsctl add-port br0 tap1

#ovs-vsctl set Interface tap1 ofport_request=101

 

 4.建立網絡空間ns2 虛擬網卡veth1 和 peer tap2

#ip netns add ns2

#ip link add veth2 type veth peer name tap2

#ip link set veth2 netns ns2

#ip netns exec ns2 ip link set dev veth2 up

#ip netns exec ns2 ip addr add 192.168.1.102/24 dev veth2

#ip link set dev tap2 up

 

#ovs-vsctl add-port br0 tap2

#ovs-vsctl set Interface tap2 ofport_request=102

 

5.查看流表

#root@ubuntu:~# ovs-ofctl dump-flows br0

NXST_FLOW reply (xid=0x4):

 cookie=0x0, duration=3230.736s, table=0, n_packets=0, n_bytes=0, idle_age=3230, priority=3,dl_dst=00:00:00:00:00:00 actions=drop

 cookie=0x9, duration=3230.696s, table=0, n_packets=0, n_bytes=0, idle_age=3230, priority=65535,ip,nw_proto=2 actions=CONTROLLER:65535

 cookie=0x0, duration=3230.815s, table=0, n_packets=182, n_bytes=15421, idle_age=1659, priority=0 actions=drop

 cookie=0x0, duration=3230.696s, table=0, n_packets=0, n_bytes=0, idle_age=3230, priority=3,dl_src=00:00:00:00:00:00 actions=drop

 cookie=0x0, duration=3230.696s, table=0, n_packets=0, n_bytes=0, idle_age=3230, priority=3,dl_src=ff:ff:ff:ff:ff:ff actions=drop

cookie=0x0, duration=3230.777s, table=1, n_packets=181, n_bytes=15379, idle_age=1659, priority=0 actions=drop

 cookie=0x0, duration=3230.776s, table=2, n_packets=181, n_bytes=15379, idle_age=1659, priority=0 actions=drop

 cookie=0x0, duration=3230.776s, table=3, n_packets=27, n_bytes=1439, idle_age=1659, priority=0 actions=CONTROLLER:65535

 

6.測試連通性

終端1執行#ip netns exec ns0 ping 192.168.1.101

終端2執行# ip netns exec ns1 tcpdump –i veth1    終端2會顯示 veth0 – veth2的icmp交互信息

 

7.添加流表，修改來自port100 的源地址爲222.222.137.1

#ovs-ofctl add-flow br0 "priority=1 idle_timeout=0,in_port=100,actions=mod_nw_src:222.222.137.1,normal"

 

執行第6的測試 顯示

root@ubuntu:~# ip netns exec ns1 tcpdump -i veth1 -v

tcpdump: listening on veth1, link-type EN10MB (Ethernet), capture size 65535 bytes

^C01:54:49.822143 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 24) :: > ff02::1:ff6f:c5b8: [icmp6 sum ok] ICMP6, neighbor solicitation, length 24, who has fe80::ac78:4bff:fe6f:c5b8

01:54:49.994149 IP (tos 0x0, ttl 64, id 12026, offset 0, flags [DF], proto ICMP (1), length 84)

222.222.137.1 > 192.168.1.101: ICMP echo request, id 21405, seq 244, length 64

 

8.刪除 port 100上全部流表

#ovs-ofctl del-flows ovs-switch "in_port=100"

 

9.測試IP匹配流表, 將192.168.1.100  ping 192.168.101的報文 轉到port 102 (192.168.1.102)

#ovs-ofctl add-flow br0 "priority=111 idle_timeout=0,dl_type=0x0800,nw_src=192.168.1.100,nw_dst=192.168.1.101,actions=output:102"

 

root@ubuntu:/home/chulk/sdn/openmul# ip netns exec ns2 tcpdump -i veth2 icmp

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on veth2, link-type EN10MB (Ethernet), capture size 65535 bytes

^C01:21:05.933940 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 43886, seq 32, length 64

01:21:08.934038 IP 192.168.1.100 > 192.168.1.101: ICMP echo request, id 43886, seq 35, length 64

 

測試tcp 數據匹配

終端 1執行ip netns exec ns2 tcpdump -i veth2 icmp

終端2執行#ip netns exec ns1 nc -lp 1234 > test.log      //服務端 192.168.1.101:1234

終端3執行#ip netns exec ns0 nc -w 1 192.168.1.101 1234 < test.log //veth0 tcp鏈接veth1

        

 注:Test.log爲測試文件，用來測試veth0 veth1直接文件傳輸，至關於遠程拷貝，其餘參考：http://blog.csdn.net/wang7dao/article/details/7684998;也能夠用netperf測試。

 

終端1會顯示TCP會話報文,只有SYN請求， 由於鏈接的報文本應該去101,可是被流表導向了102，因此致使沒有ack響應報文。

         root@ubuntu:~# ip netns exec ns2 tcpdump -i veth2

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on veth2, link-type EN10MB (Ethernet), capture size 65535 bytes

01:42:43.809629 IP 192.168.1.100.38815 > 192.168.1.101.1234: Flags [S], seq 2964554190, win 29200, options [mss 1460,sackOK,TS val 65016423 ecr 0,nop,wscale 7], length 0

01:42:44.632833 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3a:e4:96:ae:57:9f (oui Unknown), length 300

01:42:44.806696 IP 192.168.1.100.38815 > 192.168.1.101.1234: Flags [S], seq 2964554190, win 29200, options [mss 1460,sackOK,TS val 65016673 ecr 0,nop,wscale 7], length 0

 

10.IP+PORT流表

#ovs-ofctl add-flow br0 "priority=111 idle_timeout=0,dl_type=0x0800,nw_src=192.168.1.100,nw_dst=192.168.1.101,nw_proto=6,tp_dst=1234,actions=output:102"  //按照9的測試，修改這個tp_dst=1234將不會獲取到tcp的SYN報文（上面紅色字體部分） 每次測試僅僅是當前流表，其餘衝突流表已刪