NAME

       ovs-vswitchd - Open vSwitch daemon

SYNOPSIS

       ovs-vswitchd [database]

DESCRIPTION

       A  daemon  that  manages  and  controls  any  number of Open vSwitch switches on the local
       machine.

       The database argument specifies how ovs-vswitchd connects to ovsdb-server.  The default is
       unix:/var/run/openvswitch/db.sock.  The following forms are accepted:

       ssl:ip:port
              The  specified  SSL port on the host at the given ip, which must be expressed as an
              IP address (not a DNS name) in IPv4 or IPv6 address  format.   If  ip  is  an  IPv6
              address,   then   wrap   ip   with  square  brackets,  e.g.:  ssl:[::1]:6640.   The
              --private-key, --certificate, and --ca-cert options are mandatory when this form is
              used.

       tcp:ip:port
              Connect to the given TCP port on ip, where ip can be IPv4 or IPv6 address. If ip is
              an IPv6 address, then wrap ip with square brackets, e.g.: tcp:[::1]:6640.

       unix:file
              On POSIX, connect to the Unix domain server socket named file.

              On Windows, connect to a localhost TCP port whose value is written in file.

       pssl:port[:ip]
              Listen on the given SSL port for a connection.  By  default,  connections  are  not
              bound  to  a particular local IP address and it listens only on IPv4 (but not IPv6)
              addresses, but specifying ip limits connections to those from the given ip,  either
              IPv4 or IPv6 address.  If ip is an IPv6 address, then wrap ip with square brackets,
              e.g.: pssl:6640:[::1].  The --private-key, --certificate, and --ca-cert options are
              mandatory when this form is used.

       ptcp:port[:ip]
              Listen  on  the  given  TCP port for a connection.  By default, connections are not
              bound to a particular local IP address and it listens only on IPv4 (but  not  IPv6)
              addresses,  but ip may be specified to listen only for connections to the given ip,
              either IPv4 or IPv6 address.  If ip is an IPv6 address, then wrap  ip  with  square
              brackets, e.g.: ptcp:6640:[::1].

       punix:file
              On POSIX, listen on the Unix domain server socket named file for a connection.

              On  Windows, listen on a kernel chosen TCP port on the localhost. The kernel chosen
              TCP port value is written in file.

       ovs-vswitchd retrieves its configuration from  database  at  startup.   It  sets  up  Open
       vSwitch  datapaths  and  then  operates  switching  across  each  bridge  described in its
       configuration files.  As the database  changes,  ovs-vswitchd  automatically  updates  its
       configuration to match.

       ovs-vswitchd switches may be configured with any of the following features:

       ·      L2 switching with MAC learning.

       ·      NIC  bonding  with  automatic  fail-over  and  source  MAC-based  TX load balancing
              ("SLB").

       ·      802.1Q VLAN support.

       ·      Port mirroring, with optional VLAN tagging.

       ·      NetFlow v5 flow logging.

       ·      sFlow(R) monitoring.

       ·      Connectivity to an external OpenFlow controller, such as NOX.

       Only a single  instance  of  ovs-vswitchd  is  intended  to  run  at  a  time.   A  single
       ovs-vswitchd  can  manage  any  number  of  switch  instances, up to the maximum number of
       supported Open vSwitch datapaths.

       ovs-vswitchd does all the necessary management of Open vSwitch  datapaths  itself.   Thus,
       external  tools,  such  ovs-dpctl(8), are not needed for managing datapaths in conjunction
       with ovs-vswitchd, and their use to modify datapaths  when  ovs-vswitchd  is  running  can
       interfere with its operation.  (ovs-dpctl may still be useful for diagnostics.)

       An  Open  vSwitch  datapath  kernel  module  must be loaded for ovs-vswitchd to be useful.
       Please refer to the INSTALL.Linux file included  in  the  Open  vSwitch  distribution  for
       instructions on how to build and load the Open vSwitch kernel module.

OPTIONS

       --mlockall
              Causes  ovs-vswitchd to call the mlockall() function, to attempt to lock all of its
              process memory into physical RAM, preventing the kernel  from  paging  any  of  its
              memory  to disk.  This helps to avoid networking interruptions due to system memory
              pressure.

              Some systems do not support  mlockall()  at  all,  and  other  systems  only  allow
              privileged  users,  such  as  the  superuser,  to use it.  ovs-vswitchd emits a log
              message if mlockall() is unavailable or unsuccessful.

   DPDK Options
       --dpdk Initialize ovs-vswitchd DPDK datapath.  Refer to INSTALL.DPDK for details.

   Daemon Options
       The following options are valid on POSIX based platforms.

       --pidfile[=pidfile]
              Causes a file (by default, ovs-vswitchd.pid) to be created indicating  the  PID  of
              the  running  process.  If the pidfile argument is not specified, or if it does not
              begin with /, then it is created in /var/run/openvswitch.

              If --pidfile is not specified, no pidfile is created.

       --overwrite-pidfile
              By default, when --pidfile is specified and the specified  pidfile  already  exists
              and  is  locked  by  a  running  process,  ovs-vswitchd  refuses to start.  Specify
              --overwrite-pidfile to cause it to instead overwrite the pidfile.

              When --pidfile is not specified, this option has no effect.

       --detach
              Runs ovs-vswitchd as a background process.  The process forks, and in the child  it
              starts  a  new  session,  closes  the standard file descriptors (which has the side
              effect of disabling logging to the console), and changes its current  directory  to
              the  root  (unless  --no-chdir  is  specified).   After  the  child  completes  its
              initialization,  the  parent  exits.   ovs-vswitchd  detaches  only  after  it  has
              connected  to  the  database,  retrieved the initial configuration, and set up that
              configuration.

       --monitor
              Creates an additional process to monitor the ovs-vswitchd daemon.   If  the  daemon
              dies  due to a signal that indicates a programming error (SIGABRT, SIGALRM, SIGBUS,
              SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, or SIGXFSZ)  then  the  monitor  process
              starts  a  new  copy  of  it.   If the daemon dies or exits for another reason, the
              monitor process exits.

              This option is normally used with --detach, but it also functions without it.

       --no-chdir
              By default, when --detach is specified, ovs-vswitchd changes  its  current  working
              directory   to   the   root  directory  after  it  detaches.   Otherwise,  invoking
              ovs-vswitchd from a carelessly chosen directory  would  prevent  the  administrator
              from unmounting the file system that holds that directory.

              Specifying  --no-chdir  suppresses  this  behavior,  preventing  ovs-vswitchd  from
              changing its current working directory.  This may be  useful  for  collecting  core
              files,  since  it  is  common behavior to write core dumps into the current working
              directory and the root directory is not a good directory to use.

              This option has no effect when --detach is not specified.

       --user Causes ovs-vswitchd to run as a different  user  specified  in  "user:group",  thus
              dropping  most  of  the  root  privileges. Short forms "user" and ":group" are also
              allowed, with current user or group are assumed respectively. Only daemons  started
              by the root user accepts this argument.

              On  Linux,  daemons  will  be granted CAP_IPC_LOCK and CAP_NET_BIND_SERVICES before
              dropping root privileges. Daemons interact with  datapath,  such  as  ovs-vswitchd,
              will  be granted two additional capabilities, namely CAP_NET_ADMIN and CAP_NET_RAW.
              The capability change will apply even if new user is "root".

              On  Windows,  this  option  is  not  currently  supported.  For  security  reasons,
              specifying this option will cause the daemon process not to start.

   Service Options
       The following options are valid only on Windows platform.

       --service
              Causes  ovs-vswitchd  to  run  as  a  service in the background. The service should
              already have been created through external tools like SC.exe.

       --service-monitor
              Causes the ovs-vswitchd service  to  be  automatically  restarted  by  the  Windows
              services manager if the service dies or exits for unexpected reasons.

              When --service is not specified, this option has no effect.

   Public Key Infrastructure Options
       -p privkey.pem
       --private-key=privkey.pem
              Specifies a PEM file containing the private key used as ovs-vswitchd's identity for
              outgoing SSL connections.

       -c cert.pem
       --certificate=cert.pem
              Specifies a PEM file containing  a  certificate  that  certifies  the  private  key
              specified on -p or --private-key to be trustworthy.  The certificate must be signed
              by the certificate authority (CA) that the peer in  SSL  connections  will  use  to
              verify it.

       -C cacert.pem
       --ca-cert=cacert.pem
              Specifies  a PEM file containing the CA certificate that ovs-vswitchd should use to
              verify certificates  presented  to  it  by  SSL  peers.   (This  may  be  the  same
              certificate  that  SSL  peers  use  to  verify  the  certificate specified on -c or
              --certificate, or it may be a different one, depending on the PKI design in use.)

       -C none
       --ca-cert=none
              Disables verification of certificates presented by SSL peers.   This  introduces  a
              security risk, because it means that certificates cannot be verified to be those of
              known trusted hosts.

       --bootstrap-ca-cert=cacert.pem
              When cacert.pem exists, this option has the same effect as -C or --ca-cert.  If  it
              does  not  exist,  then ovs-vswitchd will attempt to obtain the CA certificate from
              the SSL peer on its first SSL connection and save it to the named PEM file.  If  it
              is successful, it will immediately drop the connection and reconnect, and from then
              on all SSL connections must be authenticated by a  certificate  signed  by  the  CA
              certificate thus obtained.

              This  option exposes the SSL connection to a man-in-the-middle attack obtaining the
              initial CA certificate, but it may be useful for bootstrapping.

              This option is only useful if the SSL peer sends its CA certificate as part of  the
              SSL certificate chain.  The SSL protocol does not require the server to send the CA
              certificate.

              This option is mutually exclusive with -C and --ca-cert.

   Logging Options
       -v[spec]
       --verbose=[spec]
              Sets logging levels.  Without any spec, sets the log level  for  every  module  and
              destination  to  dbg.   Otherwise,  spec  is a list of words separated by spaces or
              commas or colons, up to one from each category below:

              ·      A valid module name, as displayed by the vlog/list command on ovs-appctl(8),
                     limits the log level change to the specified module.

              ·      syslog,  console,  or  file,  to  limit  the log level change to only to the
                     system log, to the console, or to a file,  respectively.   (If  --detach  is
                     specified,  ovs-vswitchd closes its standard file descriptors, so logging to
                     the console will have no effect.)

                     On Windows platform, syslog is accepted as a word and is only  useful  along
                     with the --syslog-target option (the word has no effect otherwise).

              ·      off,  emer,  err, warn, info, or dbg, to control the log level.  Messages of
                     the given severity or higher will be logged, and messages of lower  severity
                     will  be filtered out.  off filters out all messages.  See ovs-appctl(8) for
                     a definition of each log level.

              Case is not significant within spec.

              Regardless of the log levels set for file, logging to a file will  not  take  place
              unless --log-file is also specified (see below).

              For  compatibility with older versions of OVS, any is accepted as a word but has no
              effect.

       -v
       --verbose
              Sets the maximum logging verbosity level, equivalent to --verbose=dbg.

       -vPATTERN:destination:pattern
       --verbose=PATTERN:destination:pattern
              Sets the log pattern for destination to pattern.   Refer  to  ovs-appctl(8)  for  a
              description of the valid syntax for pattern.

       -vFACILITY:facility
       --verbose=FACILITY:facility
              Sets  the  RFC5424  facility of the log message. facility can be one of kern, user,
              mail, daemon, auth, syslog, lpr, news, uucp, clock, ftp, ntp, audit, alert, clock2,
              local0, local1, local2, local3, local4, local5, local6 or local7. If this option is
              not specified, daemon is used as the default for the local system syslog and local0
              is  used  while  sending  a  message to the target provided via the --syslog-target
              option.

       --log-file[=file]
              Enables logging to a file.  If file is specified, then it is used as the exact name
              for  the  log  file.   The  default  log  file  name  used  if  file  is omitted is
              /var/log/openvswitch/ovs-vswitchd.log.

       --syslog-target=host:port
              Send syslog messages to UDP port on host, in addition to the  system  syslog.   The
              host must be a numerical IP address, not a hostname.

       --syslog-method=method
              Specify  method  how  syslog  messages  should be sent to syslog daemon.  Following
              forms are supported:

              ·      libc, use libc syslog() function.  This is the default  behavior.   Downside
                     of using this options is that libc adds fixed prefix to every message before
                     it is actually sent to the syslog daemon over /dev/log UNIX domain socket.

              ·      unix:file, use UNIX domain socket  directly.   It  is  possible  to  specify
                     arbitrary  message format with this option.  However, rsyslogd 8.9 and older
                     versions use hard coded parser  function  anyway  that  limits  UNIX  domain
                     socket use.  If you want to use arbitrary message format with older rsyslogd
                     versions, then use UDP socket to localhost IP address instead.

              ·      udp:ip:port, use UDP socket.   With  this  method  it  is  possible  to  use
                     arbitrary  message  format  also  with  older rsyslogd.  When sending syslog
                     messages over UDP socket extra precaution needs to be  taken  into  account,
                     for example, syslog daemon needs to be configured to listen on the specified
                     UDP port, accidental iptables rules could be interfering with  local  syslog
                     traffic  and  there  are  some  security  considerations  that  apply to UDP
                     sockets, but do not apply to UNIX domain sockets.

   Other Options
       --unixctl=socket
              Sets the name of the control socket  on  which  ovs-vswitchd  listens  for  runtime
              management  commands  (see RUNTIME MANAGEMENT COMMANDS, below).  If socket does not
              begin with /, it is interpreted as relative to /var/run/openvswitch.  If  --unixctl
              is       not       used      at      all,      the      default      socket      is
              /var/run/openvswitch/ovs-vswitchd.pid.ctl, where pid is ovs-vswitchd's process ID.

              On Windows, uses a kernel chosen TCP port on the localhost to  listen  for  runtime
              management  commands.   The kernel chosen TCP port value is written in a file whose
              absolute path is pointed by socket. If --unixctl is not used at all,  the  file  is
              created as ovs-vswitchd.ctl in the configured OVS_RUNDIR directory.

              Specifying none for socket disables the control socket feature.

       -h
       --help Prints a brief help message to the console.

       -V
       --version
              Prints version information to the console.

RUNTIME MANAGEMENT COMMANDS

       ovs-appctl(8)  can  send  commands  to  a  running  ovs-vswitchd  process.   The currently
       supported commands are described below.  The command descriptions assume an  understanding
       of how to configure Open vSwitch.

   GENERAL COMMANDS
       exit   Causes ovs-vswitchd to gracefully terminate.

       qos/show interface
              Queries  the  kernel for Quality of Service configuration and statistics associated
              with the given interface.

       bfd/show [interface]
              Displays detailed information about Bidirectional Forwarding  Detection  configured
              on  interface.   If  interface is not specified, then displays detailed information
              about all interfaces with BFD enabled.

       bfd/set-forwarding [interface] status
              Force the fault status of the BFD module on interface (or all interfaces if none is
              given)  to  be status.  status can be "true", "false", or "normal" which reverts to
              the standard behavior.

       cfm/show [interface]
              Displays detailed information about Connectivity  Fault  Management  configured  on
              interface.  If interface is not specified, then displays detailed information about
              all interfaces with CFM enabled.

       cfm/set-fault [interface] status
              Force the fault status of the CFM module on interface (or all interfaces if none is
              given)  to  be status.  status can be "true", "false", or "normal" which reverts to
              the standard behavior.

       stp/tcn [bridge]
              Forces a topology change event on bridge if it's running STP.  This may cause it to
              send  Topology  Change  Notifications to its peers and flush its MAC table..  If no
              bridge is given, forces a topology change event on all bridges.

   BRIDGE COMMANDS
       These commands manage bridges.

       fdb/flush [bridge]
              Flushes bridge MAC address learning table, or all learning tables if no  bridge  is
              given.

       fdb/show bridge
              Lists  each  MAC  address/VLAN pair learned by the specified bridge, along with the
              port on which it was learned and the age of the entry, in seconds.

       mdb/flush [bridge]
              Flushes bridge multicast snooping table, or all snooping tables  if  no  bridge  is
              given.

       mdb/show bridge
              Lists  each  multicast  group/VLAN pair learned by the specified bridge, along with
              the port on which it was learned and the age of the entry, in seconds.

       bridge/reconnect [bridge]
              Makes bridge drop all of its OpenFlow controller  connections  and  reconnect.   If
              bridge  is  not  specified,  then all bridges drop their controller connections and
              reconnect.

              This command might be useful for debugging OpenFlow controller issues.

       bridge/dump-flows bridge
              Lists all flows in bridge, including those normally  hidden  to  commands  such  as
              ovs-ofctl dump-flows.  Flows set up by mechanisms such as in-band control and fail-
              open are hidden from the controller since it is not allowed to modify  or  override
              them.

   BOND COMMANDS
       These  commands  manage  bonded ports on an Open vSwitch's bridges.  To understand some of
       these commands, it is important to understand  a  detail  of  the  bonding  implementation
       called  ``source  load  balancing''  (SLB).  Instead of directly assigning Ethernet source
       addresses to slaves, the bonding implementation computes a function that  maps  an  48-bit
       Ethernet source addresses into an 8-bit value (a ``MAC hash'' value).  All of the Ethernet
       addresses that map to a single 8-bit value are then assigned to a single slave.

       bond/list
              Lists all of the bonds, and their slaves, on each bridge.

       bond/show [port]
              Lists all of the bond-specific information (updelay, downdelay, time until the next
              rebalance)  about  the  given bonded port, or all bonded ports if no port is given.
              Also lists information about each slave: whether it is  enabled  or  disabled,  the
              time  to completion of an updelay or downdelay if one is in progress, whether it is
              the active slave, the hashes assigned to the slave.  Any LACP  information  related
              to this bond may be found using the lacp/show command.

       bond/migrate port hash slave
              Only valid for SLB bonds.  Assigns a given MAC hash to a new slave.  port specifies
              the bond port, hash the MAC hash to be migrated (as a decimal number between 0  and
              255), and slave the new slave to be assigned.

              The reassignment is not permanent: rebalancing or fail-over will cause the MAC hash
              to be shifted to a new slave in the usual manner.

              A MAC hash cannot be migrated to a disabled slave.

       bond/set-active-slave port slave
              Sets slave as the active slave on port.  slave must currently be enabled.

              The setting is not permanent: a new active slave will be selected if slave  becomes
              disabled.

       bond/enable-slave port slave
       bond/disable-slave port slave
              Enables  (or  disables)  slave  on  the  given  bond port, skipping any updelay (or
              downdelay).

              This setting is not permanent: it persists only until the carrier status  of  slave
              changes.

       bond/hash mac [vlan] [basis]
              Returns  the  hash  value  which  would  be  used  for  mac  with vlan and basis if
              specified.

       lacp/show [port]
              Lists all of the LACP related information about the given port: active or  passive,
              aggregation key, system id, and system priority.  Also lists information about each
              slave: whether it is enabled or disabled, whether it is attached or detached,  port
              id  and  priority,  actor  information,  and  partner  information.  If port is not
              specified, then  displays  detailed  information  about  all  interfaces  with  CFM
              enabled.

   DPCTL DATAPATH DEBUGGING COMMANDS
       The primary way to configure ovs-vswitchd is through the Open vSwitch database, e.g. using
       ovs-vsctl(8).  These commands provide a debugging interface for managing datapaths.   They
       implement  the  same  features  (and  syntax) as ovs-dpctl(8).  Unlike ovs-dpctl(8), these
       commands work with datapaths that  are  integrated  into  ovs-vswitchd  (e.g.  the  netdev
       datapath type).

       dpctl/add-dp dp [netdev[,option]...]
              Creates  datapath dp, with a local port also named dp.  This will fail if a network
              device dp already exists.

              If netdevs are specified, ovs-vswitchd adds them to the new datapath,  just  as  if
              add-if was specified.

       dpctl/del-dp dp
              Deletes  datapath  dp.   If  dp  is  associated  with any network devices, they are
              automatically removed.

       dpctl/add-if dp netdev[,option]...
              Adds each netdev to the set of network devices datapath dp monitors,  where  dp  is
              the  name  of  an  existing  datapath,  and netdev is the name of one of the host's
              network devices, e.g. eth0.  Once a network device has been added  to  a  datapath,
              the datapath has complete ownership of the network device's traffic and the network
              device appears silent to the rest of the system.

              A netdev may be followed by a  comma-separated  list  of  options.   The  following
              options are currently supported:

              type=type
                     Specifies the type of port to add.  The default type is system.

              port_no=port
                     Requests  a specific port number within the datapath.  If this option is not
                     specified then one will be automatically assigned.

              key=value
                     Adds an arbitrary key-value option to the port's configuration.

              ovs-vswitchd.conf.db(5) documents the available port types and options.

       dpctl/set-if dp port[,option]...
              Reconfigures each port in dp as specified.  An option of the  form  key=value  adds
              the  specified  key-value  option to the port or overrides an existing key's value.
              An option of the form key=, that is, without a value, deletes the  key-value  named
              key.  The type and port number of a port cannot be changed, so type and port_no are
              only allowed if they match the existing configuration.

       dpctl/del-if dp netdev...
              Removes each netdev from the list of network devices datapath dp monitors.

       dpctl/dump-dps
              Prints the name of each configured datapath on a separate line.

       dpctl/show [-s | --statistics] [dp...]
              Prints a summary of configured datapaths, including their datapath  numbers  and  a
              list  of  ports  connected to each datapath.  (The local port is identified as port
              0.)  If -s or --statistics is specified, then packet and  byte  counters  are  also
              printed for each port.

              The datapath numbers consists of flow stats and mega flow mask stats.

              The  "lookups"  row  displays  three  stats  related  to  flow  lookup triggered by
              processing incoming packets in the  datapath.  "hit"  displays  number  of  packets
              matches  existing  flows.  "missed" displays the number of packets not matching any
              existing flow and require user space processing.  "lost" displays number of packets
              destined for user space process but subsequently dropped before reaching userspace.
              The sum of "hit" and  "miss"  equals  to  the  total  number  of  packets  datapath
              processed.

              The "flows" row displays the number of flows in datapath.

              The "masks" row displays the mega flow mask stats. This row is omitted for datapath
              not implementing mega flow. "hit" displays the total number of  masks  visited  for
              matching  incoming  packets.  "total"  displays  number  of  masks in the datapath.
              "hit/pkt" displays the average number  of  masks  visited  per  packet;  the  ratio
              between "hit" and total number of packets processed by the datapath".

              If  one  or  more  datapaths are specified, information on only those datapaths are
              displayed.  Otherwise,  ovs-vswitchd  displays  information  about  all  configured
              datapaths.

   DATAPATH FLOW TABLE DEBUGGING COMMANDS
       The  following  commands  are primarily useful for debugging Open vSwitch.  The flow table
       entries (both matches and actions) that they work with  are  not  OpenFlow  flow  entries.
       Instead,  they are different and considerably simpler flows maintained by the Open vSwitch
       kernel module.  Use ovs-ofctl(8), instead, to work with OpenFlow flow entries.

       The dp argument to each of these commands is optional when exactly one datapath exists, in
       which  case  that datapath is the default.  When multiple datapaths exist, then a datapath
       name is required.

       dpctl/dump-flows [-m | --more] [dp] [filter=filter]
              Prints to the console all flow entries in datapath dp's flow table.  Without -m  or
              --more,  output  omits  match  fields  that  a  flow wildcards entirely; with -m or
              --more, output includes all wildcarded fields.

              If filter=filter is specified, only displays  the  flows  that  match  the  filter.
              filter  is  a flow in the form similiar to that accepted by ovs-ofctl(8)'s add-flow
              command. (This is not  an  OpenFlow  flow:  besides  other  differences,  it  never
              contains  wildcards.)   The filter is also useful to match wildcarded fields in the
              datapath flow. As an example, filter='tcp,tp_src=100' will match the datapath  flow
              containing 'tcp(src=80/0xff00,dst=8080/0xff)'.

       dpctl/add-flow [dp] flow actions

       dpctl/mod-flow [--clear] [--may-create] [-s | --statistics] [dp] flow actions
              Adds  or  modifies  a  flow  in  dp's  flow table that, when a packet matching flow
              arrives, causes actions to be executed.

              The add-flow  command  succeeds  only  if  flow  does  not  already  exist  in  dp.
              Contrariwise,  mod-flow  without  --may-create  only  modifies  the  actions for an
              existing flow.  With --may-create, mod-flow will  add  a  new  flow  or  modify  an
              existing one.

              If  -s  or  --statistics  is  specified,  then  mod-flow prints the modified flow's
              statistics.  A flow's statistics are the number of  packets  and  bytes  that  have
              passed  through  the  flow, the elapsed time since the flow last processed a packet
              (if ever), and (for TCP flows) the union of the TCP  flags  processed  through  the
              flow.

              With  --clear, mod-flow zeros out the flow's statistics.  The statistics printed if
              -s or --statistics is also specified  are  those  from  just  before  clearing  the
              statistics.

       dpctl/del-flow [-s | --statistics] [dp] flow
              Deletes  the flow from dp's flow table that matches flow.  If -s or --statistics is
              specified, then del-flow prints the deleted flow's statistics.

       dpctl/get-flow [dp] ufid:ufid
              Fetches the flow from dp's flow table with unique identifier ufid.   ufid  must  be
              specified as a string of 32 hexadecimal characters.

       dpctl/del-flows [dp]
              Deletes all flow entries from datapath dp's flow table.

   CONNECTION TRACKING TABLE DEBUGGING COMMANDS
       The  following commands are primarily useful for debugging the connection tracking entries
       in the datapath.

       The dp argument to each of these commands is optional when exactly one datapath exists, in
       which  case  that datapath is the default.  When multiple datapaths exist, then a datapath
       name is required.

       N.B.(Linux specific): the system datapaths (i.e. the  Linux  kernel  module  Open  vSwitch
       datapaths)  share  a  single connection tracking table (which is also used by other kernel
       subsystems, such as iptables, nftables  and  the  regular  host  stack).   Therefore,  the
       following commands do not apply specifically to one datapath.

       dpctl/dump-conntrack [-m | --more] [-s | --statistics] [dp] [zone=zone]
              Prints  to  the  console  all the connection entries in the tracker used by dp.  If
              zone=zone is specified, only shows the connections  in  zone.   With  --more,  some
              implementation  specific  details  are  included.  With  --statistics  timeouts and
              timestamps are added to the output.

       dpctl/flush-conntrack [dp] [zone=zone]
              Flushes all the connection entries in the tracker used  by  dp.   If  zone=zone  is
              specified, only flushes the connections in zone.

   DPIF-NETDEV COMMANDS
       These  commands  are  used  to  expose  internal information (mostly statistics) about the
       ``dpif-netdev'' userspace datapath. If there is only one datapath (as is often  the  case,
       unless dpctl/ commands are used), the dp argument can be omitted.

       dpif-netdev/pmd-stats-show [dp]
              Shows  performance  statistics for each pmd thread of the datapath dp.  The special
              thread ``main'' sums up the statistics of every non pmd thread.  The sum  of  ``emc
              hits'',  ``masked  hits''  and  ``miss''  is  the number of packets received by t
            
Was this answer helpful? 20 Users Found This Useful (0 Votes)