单主机上实现
ovs转发模式
ovs网桥有两种转发模式,默认是standalone模式,当连接不上控制器时会使用ovs默认的转发逻辑,secure模式不使用默认的转发模式使用现有的流表来处理转发逻辑,下面两个命令可以设置ovs的转发模式
ovs-vsctl set-fail-mode br-ovs standalone
ovs-vsctl set-fail-mode br-ovs secure
在我们的拓扑中使用secure模式,使用我们自定义的流表来实现转发
ovs-vsctl set-fail-mode br-ovs secure
网络拓扑
br-ovs是ovs网桥
br1、br2、br3、br4是linux网桥
ns11、ns12、ns21、ns22、ns31、ns32、ns41、ns42是网络命名空间
# 构建拓扑
# 创建ovs网桥
ovs-vsctl add-br br-ovs
# 创建linux网桥
brctl addbr br1
brctl addbr br2
brctl addbr br3
brctl addbr br4
ifconfig br1 up
ifconfig br2 up
ifconfig br3 up
ifconfig br4 up
# 创建网络命名空间
ip netns add ns11
ip netns add ns12
ip netns add ns21
ip netns add ns22
ip netns add ns31
ip netns add ns32
ip netns add ns41
ip netns add ns42
# 创建连接ovs网桥与linux网桥的veth pair
ip link add name veth01 type veth peer name veth11
ip link add name veth02 type veth peer name veth12
ip link add name veth03 type veth peer name veth13
ip link add name veth04 type veth peer name veth14
ifconfig veth01 up
ifconfig veth02 up
ifconfig veth03 up
ifconfig veth04 up
ifconfig veth11 up
ifconfig veth12 up
ifconfig veth13 up
ifconfig veth14 up
# 将veth pair分别加入到ovs网桥和linux网桥
ovs-vsctl add-port br-ovs veth01
ovs-vsctl add-port br-ovs veth02
ovs-vsctl add-port br-ovs veth03
ovs-vsctl add-port br-ovs veth04
brctl addif br1 veth11
brctl addif br2 veth12
brctl addif br3 veth13
brctl addif br4 veth14
# 创建linux网桥和和网络命名空间的veth pair
ip link add name br1-ns11 type veth peer name ns11-br1
ip link add name br1-ns12 type veth peer name ns12-br1
ifconfig br1-ns11 up
ifconfig ns11-br1 up
ifconfig br1-ns12 up
ifconfig ns12-br1 up
ip link add name br2-ns21 type veth peer name ns21-br2
ip link add name br2-ns22 type veth peer name ns22-br2
ifconfig br2-ns21 up
ifconfig ns21-br2 up
ifconfig br2-ns22 up
ifconfig ns22-br2 up
ip link add name br3-ns31 type veth peer name ns31-br3
ip link add name br3-ns32 type veth peer name ns32-br3
ifconfig br3-ns31 up
ifconfig ns31-br3 up
ifconfig br3-ns32 up
ifconfig ns32-br3 up
ip link add name br4-ns41 type veth peer name ns41-br4
ip link add name br4-ns42 type veth peer name ns42-br4
ifconfig br4-ns41 up
ifconfig ns41-br4 up
ifconfig br4-ns42 up
ifconfig ns42-br4 up
# 将veth pair添加加到linux网桥和网络命名空间
brctl addif br1 br1-ns11
brctl addif br1 br1-ns12
brctl addif br2 br2-ns21
brctl addif br2 br2-ns22
brctl addif br3 br3-ns31
brctl addif br3 br3-ns32
brctl addif br4 br4-ns41
brctl addif br4 br4-ns42
ip link set dev ns11-br1 netns ns11
ip netns exec ns11 ifconfig ns11-br1 up
ip netns exec ns11 ifconfig ns11-br1 192.168.1.2
ip netns exec ns11 route add default gw 192.168.1.1 ns11-br1
ip link set dev ns12-br1 netns ns12
ip netns exec ns12 ifconfig ns12-br1 up
ip netns exec ns12 ifconfig ns12-br1 192.168.1.3
ip netns exec ns12 route add default gw 192.168.1.1 ns12-br1
ip link set dev ns21-br2 netns ns21
ip netns exec ns21 ifconfig ns21-br2 up
ip netns exec ns21 ifconfig ns21-br2 192.168.2.2
ip netns exec ns21 route add default gw 192.168.2.1 ns21-br2
ip link set dev ns22-br2 netns ns22
ip netns exec ns22 ifconfig ns22-br2 up
ip netns exec ns22 ifconfig ns22-br2 192.168.2.3
ip netns exec ns22 route add default gw 192.168.2.1 ns22-br2
ip link set dev ns31-br3 netns ns31
ip netns exec ns31 ifconfig ns31-br3 up
ip netns exec ns31 ifconfig ns31-br3 192.168.3.2
ip netns exec ns31 route add default gw 192.168.3.1 ns31-br3
ip link set dev ns32-br3 netns ns32
ip netns exec ns32 ifconfig ns32-br3 up
ip netns exec ns32 ifconfig ns32-br3 192.168.3.3
ip netns exec ns32 route add default gw 192.168.3.1 ns32-br3
ip link set dev ns41-br4 netns ns41
ip netns exec ns41 ifconfig ns41-br4 up
ip netns exec ns41 ifconfig ns41-br4 192.168.3.4
ip netns exec ns41 route add default gw 192.168.3.1 ns41-br4
ip link set dev ns42-br4 netns ns42
ip netns exec ns42 ifconfig ns42-br4 up
ip netns exec ns42 ifconfig ns42-br4 192.168.3.5
ip netns exec ns42 route add default gw 192.168.3.1 ns42-br4
清理环境
ovs-vsctl del-br br-ovs
ip netns del ns11
ip netns del ns12
ip netns del ns21
ip netns del ns22
ip netns del ns31
ip netns del ns32
ip netns del ns41
ip netns del ns42
ifconfig veth01 down
ifconfig veth02 down
ifconfig veth03 down
ifconfig veth04 down
ifconfig veth11 down
ifconfig veth12 down
ifconfig veth13 down
ifconfig veth14 down
ip link delete name veth01 type veth peer name veth11
ip link delete name veth02 type veth peer name veth12
ip link delete name veth03 type veth peer name veth13
ip link delete name veth04 type veth peer name veth14
ip link delete name br1-ns11 type veth peer name ns11-br1
ip link delete name br1-ns12 type veth peer name ns12-br1
ip link delete name br2-ns21 type veth peer name ns21-br2
ip link delete name br2-ns22 type veth peer name ns22-br2
ip link delete name br3-ns31 type veth peer name ns31-br3
ip link delete name br3-ns32 type veth peer name ns32-br3
ip link delete name br4-ns41 type veth peer name ns41-br4
ip link delete name br4-ns42 type veth peer name ns42-br4
ifconfig br1 down
ifconfig br2 down
ifconfig br3 down
ifconfig br4 down
brctl delbr br1
brctl delbr br2
brctl delbr br3
brctl delbr br4
测试
-
ns11 ping ns12
[root@localhost ~]# ip netns exec ns11 ping 192.168.1.3 PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data. 64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.052 ms 64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.096 ms
-
ns21 ping ns22
[root@localhost ~]# ip netns exec ns21 ping 192.168.2.3 PING 192.168.2.3 (192.168.2.3) 56(84) bytes of data. 64 bytes from 192.168.2.3: icmp_seq=1 ttl=64 time=0.249 ms 64 bytes from 192.168.2.3: icmp_seq=2 ttl=64 time=0.143 ms ^C
-
ns31 ping ns32
[root@localhost ~]# ip netns exec ns31 ping 192.168.3.3 PING 192.168.3.3 (192.168.3.3) 56(84) bytes of data. 64 bytes from 192.168.3.3: icmp_seq=1 ttl=64 time=0.246 ms 64 bytes from 192.168.3.3: icmp_seq=2 ttl=64 time=0.075 ms ^C
-
ns41 ping ns42
[root@localhost ~]# ip netns exec ns41 ping 192.168.3.5 PING 192.168.3.5 (192.168.3.5) 56(84) bytes of data. 64 bytes from 192.168.3.5: icmp_seq=1 ttl=64 time=0.077 ms 64 bytes from 192.168.3.5: icmp_seq=2 ttl=64 time=0.062 ms ^C
-
ns41 ping ns31,不同网桥下同网段仍然是不通的
[root@localhost ~]# ip netns exec ns41 ping 192.168.3.3 PING 192.168.3.3 (192.168.3.3) 56(84) bytes of data. ^C --- 192.168.3.3 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
同一个linux网桥下的网络命名空间是互通的,但是不同linux下的网络命名空间是不通的
设计br-ovs的流表
openflow默认有256张流表,每张流表里可以有多个匹配规则
在匹配中可以使用metadata来携带信息,metadata是一个64bit的一段空间
可以使用metadata的前32位来表示路由器id,中间32位来表示路由器下的子网,因此最多支持创建2^32个路由器,每个路由器下最多可以创建2^32个子网
首先考虑同子网之间的转发
对于同子网之间的转发在我们的拓扑中分为两种情况,br3和br4属于同一个子网
情况1:ns31访问ns32,由于这两个网络命名空间都属于br3,所以说就算br-ovs不做任何处理也是能够访问通的
情况2:ns31访问ns41,由于这两个网络命名空间分别属于br3和br4,因此br-ovs需要处理
正常的报文处理情况:
报文转发的第一个报文是arp请求,比如ns31访问ns41时,已经知道了ns41的ip,并且ns31和ns41属于同一个子网,因此ns31会发送arp报文,根据ns41的ip地址获取ns41的mac地址。
注意的情况:
arp广播隔离:ns31发送ns41的arp广播时只需要将报文广播到同一个子网的其他端口,对于广播可以使用ovs的组表来进行实现
arp回复单薄报文处理:ns41回复arp是单播的,因此需要在br-ovs上判断报文需要从哪个端口发出,因此需要一个mac地址表,可以根据目的mac地址来判断将报文从哪里发送出去,mac地址表是需要实时学习的
table:0可以定义为流量的入口表
table:60 arp广播表,用于同网段的子网arp广播
table:80mac地址表,根据mac地址来判断将报文从哪个端口发送出去
table:253可以定义为流量的出口表
现在假设这个拓扑的路由id是1,br1的子网id是1,br2的子网id是2,br3和br4的子网id是3,下面便可以添加流表了
# arp广播组表
ovs-ofctl -O OpenFlow13 add-group br-ovs "group_id=1,type=all"
ovs-ofctl -O OpenFlow13 add-group br-ovs "group_id=2,type=all"
ovs-ofctl -O OpenFlow13 add-group br-ovs "group_id=3,type=all,bucket=actions=pop_vlan,output:veth03,bucket=actions=pop_vlan,output:veth04"
# 入口表
ovs-ofctl add-flow br-ovs "table=0,priority=50,in_port=veth01,actions=write_metadata:0x100000001/0x100000001,goto_table:60" -O Openflow13
ovs-ofctl add-flow br-ovs "table=0,priority=50,in_port=veth02,actions=write_metadata:0x100000002/0x100000002,goto_table:60" -O Openflow13
ovs-ofctl add-flow br-ovs "table=0,priority=50,in_port=veth03,actions=write_metadata:0x100000003/0x100000003,goto_table:60" -O Openflow13
ovs-ofctl add-flow br-ovs "table=0,priority=50,in_port=veth04,actions=write_metadata:0x100000003/0x100000003,goto_table:60" -O Openflow13
# arp广播表,如果写代码,这里需要将报文给到控制器,控制器解析arp报文信息,然后控制器需要下发mac地址表
ovs-ofctl add-flow br-ovs "table=60,priority=50,arp,dl_dst=ff:ff:ff:ff:ff:ff,metadata=0x100000001/0xffffffffffffffff,actions=group:1" -O Openflow13
ovs-ofctl add-flow br-ovs "table=60,priority=50,arp,dl_dst=ff:ff:ff:ff:ff:ff,metadata=0x100000002/0xffffffffffffffff,actions=group:2" -O Openflow13
ovs-ofctl add-flow br-ovs "table=60,priority=50,arp,dl_dst=ff:ff:ff:ff:ff:ff,metadata=0x100000003/0xffffffffffffffff,actions=group:3" -O Openflow13
ovs-ofctl add-flow br-ovs "table=60,priority=0,actions=goto_table:80" -O Openflow13
# mac地址表
# 添加缺省流表
ovs-ofctl add-flow br-ovs "table=80, priority=100,dl_dst=6a:c0:40:84:2e:67,actions=set_field:0x3->reg11,goto_table:253" -O Openflow13
ovs-ofctl add-flow br-ovs "table=80, priority=100,dl_dst=8e:e6:d4:63:1a:86,actions=set_field:0x3->reg11,goto_table:253" -O Openflow13
ovs-ofctl add-flow br-ovs "table=80, priority=100,dl_dst=36:a1:21:19:f4:fb,actions=set_field:0x4->reg11,goto_table:253" -O Openflow13
ovs-ofctl add-flow br-ovs "table=80, priority=100,dl_dst=3e:97:f8:fb:90:22,actions=set_field:0x4->reg11,goto_table:253" -O Openflow13
# 出端口表
ovs-ofctl add-flow br-ovs "table=253,priority=50,reg11=0x1,actions=output:veth01" -O Openflow13
ovs-ofctl add-flow br-ovs "table=253,priority=50,reg11=0x2,actions=output:veth02" -O Openflow13
ovs-ofctl add-flow br-ovs "table=253,priority=50,reg11=0x3,actions=output:veth03" -O Openflow13
ovs-ofctl add-flow br-ovs "table=253,priority=50,reg11=0x4,actions=output:veth04" -O Openflow13
验证结果
[root@localhost ~]# ip netns exec ns31 ping 192.168.3.4
PING 192.168.3.4 (192.168.3.4) 56(84) bytes of data.
64 bytes from 192.168.3.4: icmp_seq=108 ttl=64 time=2009 ms
64 bytes from 192.168.3.4: icmp_seq=109 ttl=64 time=1007 ms
64 bytes from 192.168.3.4: icmp_seq=110 ttl=64 time=5.03 ms
64 bytes from 192.168.3.4: icmp_seq=111 ttl=64 time=0.130 ms
64 bytes from 192.168.3.4: icmp_seq=112 ttl=64 time=0.115 ms
64 bytes from 192.168.3.4: icmp_seq=113 ttl=64 time=0.185 ms
^C
--- 192.168.3.4 ping statistics ---
现在br3和br4之间是同子网是可以互通的,现在需要解决不同子网之间是否互通
考虑不同子网之间的转发
不同网段之间互通是需要经过路由的,需要进行L3的转发,首先说明一下不同子网之间访问时的流程
假设ns11访问ns21:192.168.1.2访问192.168.2.2
ns11发现访问ns21时根据默认路由会发送arp报文,会获取网关192.168.1.1的mac地址,然后将报文发送到网关
可以利用网络命名空间的路由转发功能来实现路由功能
核心点:
需要获取网关的mac地址,因此需要将发往网关的arp请求从指定的端口发送到router网络命名空间,对于需要响应的arp报文根据mac表返回
报文从网关发出时仍然需要arp,这里的处理就和同一个子网的处理一致了
添加流表
# 创建router
ip netns add router
# 开启转发功能
sysctl -w net.ipv4.ip_forward=1
# 创建router与br-ovs之间连接的veth pair
ip link add name gw00 type veth peer name gw10
ip link add name gw01 type veth peer name gw11
ip link add name gw02 type veth peer name gw12
ifconfig gw00 up
ifconfig gw10 up
ifconfig gw10 up
ifconfig gw11 up
ifconfig gw02 up
ifconfig gw12 up
# gw00是br1的网关 gw01是br2的网关 gw02是br3和br4的网关
# 将gw00和gw01和gw02添加到br-ovs
ovs-vsctl add-port br-ovs gw00
ovs-vsctl add-port br-ovs gw01
ovs-vsctl add-port br-ovs gw02
# 将gw10和gw11添加到router
ip link set dev gw10 netns router
ip netns exec router ifconfig gw10 up
ip netns exec router ifconfig gw10 192.168.1.1
ip link set dev gw11 netns router
ip netns exec router ifconfig gw11 up
ip netns exec router ifconfig gw11 192.168.2.1
ip link set dev gw12 netns router
ip netns exec router ifconfig gw12 up
ip netns exec router ifconfig gw12 192.168.3.1
测试结果
上面的流表已经实现了二层个三层转发了,接下来进行测试
-
br1上两个网络命名空间互通
[root@localhost ~]# ip netns exec ns11 ping 192.168.1.3 PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data. 64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.251 ms 64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.123 ms 64 bytes from 192.168.1.3: icmp_seq=3 ttl=64 time=0.123 ms 64 bytes from 192.168.1.3: icmp_seq=4 ttl=64 time=0.125 ms ^C --- 192.168.1.3 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3001ms rtt min/avg/max/mdev = 0.123/0.155/0.251/0.056 ms
-
br1上的ns11访问网关192.168.1.1
[root@localhost ~]# ip netns exec ns11 ping 192.168.1.1 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.520 ms 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.106 ms 64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.132 ms 64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.127 ms ^C --- 192.168.1.1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3001ms rtt min/avg/max/mdev = 0.106/0.221/0.520/0.173 ms
-
br1下的ns11访问br3的ns31
[root@localhost ~]# ip netns exec ns11 ping 192.168.3.2 PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data. 64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=1.17 ms 64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.150 ms 64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.136 ms ^C --- 192.168.3.2 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 0.136/0.488/1.178/0.487 ms
-
br1下的ns11访问br4的ns41
[root@localhost ~]# ip netns exec ns11 ping 192.168.3.5 PING 192.168.3.5 (192.168.3.5) 56(84) bytes of data. 64 bytes from 192.168.3.5: icmp_seq=1 ttl=63 time=0.621 ms 64 bytes from 192.168.3.5: icmp_seq=2 ttl=63 time=0.178 ms 64 bytes from 192.168.3.5: icmp_seq=3 ttl=63 time=0.189 ms 64 bytes from 192.168.3.5: icmp_seq=4 ttl=63 time=0.115 ms ^C --- 192.168.3.5 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3002ms rtt min/avg/max/mdev = 0.115/0.275/0.621/0.202 ms
流量抓包
L2的流量走向
br3上的ns31访问br4的ns41的流量走向
-
执行ip netns exec ns31 ping 192.168.3.4
-
在br3上抓包
[root@localhost ~]# tcpdump -i br3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br3, link-type EN10MB (Ethernet), capture size 262144 bytes 00:57:57.946894 IP 192.168.3.2 > 192.168.3.4: ICMP echo request, id 58937, seq 10, length 64 00:57:57.946972 IP 192.168.3.4 > 192.168.3.2: ICMP echo reply, id 58937, seq 10, length 64 00:57:58.948350 IP 192.168.3.2 > 192.168.3.4: ICMP echo request, id 58937, seq 11, length 64 00:57:58.948458 IP 192.168.3.4 > 192.168.3.2: ICMP echo reply, id 58937, seq 11, length 64 00:57:59.948873 IP 192.168.3.2 > 192.168.3.4: ICMP echo request, id 58937, seq 12, length 64 00:57:59.948979 IP 192.168.3.4 > 192.168.3.2: ICMP echo reply, id 58937, seq 12, length 64
-
在br4上抓包
[root@localhost ~]# tcpdump -i br4 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br4, link-type EN10MB (Ethernet), capture size 262144 bytes 00:58:18.979157 IP 192.168.3.2 > 192.168.3.4: ICMP echo request, id 58937, seq 31, length 64 00:58:18.979223 IP 192.168.3.4 > 192.168.3.2: ICMP echo reply, id 58937, seq 31, length 64 00:58:19.980623 IP 192.168.3.2 > 192.168.3.4: ICMP echo request, id 58937, seq 32, length 64 00:58:19.980693 IP 192.168.3.4 > 192.168.3.2: ICMP echo reply, id 58937, seq 32, length 64 ^C 4 packets captured 4 packets received by filter 0 packets dropped by kernel
-
在br4上的ns41上抓包
[root@localhost ~]# ip netns exec ns41 tcpdump -i ns41-br4 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ns41-br4, link-type EN10MB (Ethernet), capture size 262144 bytes 00:59:04.039108 IP 192.168.3.2 > localhost.localdomain: ICMP echo request, id 58937, seq 76, length 64 00:59:04.039162 IP localhost.localdomain > 192.168.3.2: ICMP echo reply, id 58937, seq 76, length 64 00:59:04.041106 IP localhost.localdomain.36810 > 192.168.202.2.domain: 56856+ PTR? 4.3.168.192.in-addr.arpa. (42) 00:59:04.041742 IP gateway > localhost.localdomain: ICMP net 192.168.202.2 unreachable, length 78 00:59:04.041917 IP localhost.localdomain.54507 > 192.168.202.2.domain: 56856+ PTR? 4.3.168.192.in-addr.arpa. (42) 00:59:04.041962 IP gateway > localhost.localdomain: ICMP net 192.168.202.2 unreachable, length 78 00:59:04.045646 IP localhost.localdomain.40902 > 192.168.202.2.domain: 54683+ PTR? 2.3.168.192.in-addr.arpa. (42) 00:59:05.040496 IP 192.168.3.2 > localhost.localdomain: ICMP echo request, id 58937, seq 77, length 64 00:59:05.040539 IP localhost.localdomain > 192.168.3.2: ICMP echo reply, id 58937, seq 77, length 64
-
在router网络命名空间的gw10、gw11、gw12上抓包都没有抓到报文,因此并没有走L3
流量走向:
ns31->br3->br-ovs->br4->ns41
L3的流量走向
br1上的ns11访问br4的ns42的流量走向
-
执行ip netns exec ns11 ping 192.168.3.5
-
在br1上抓包
[root@localhost ~]# tcpdump -i br1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br1, link-type EN10MB (Ethernet), capture size 262144 bytes 00:42:36.760560 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 13, length 64 00:42:36.760710 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 13, length 64 00:42:37.761034 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 14, length 64 00:42:37.761201 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 14, length 64 00:42:38.761359 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 15, length 64 00:42:38.761493 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 15, length 64 00:42:38.765249 ARP, Request who-has 192.168.1.2 tell 192.168.1.1, length 28 00:42:38.765324 ARP, Reply 192.168.1.2 is-at 9a:a8:4f:89:88:46 (oui Unknown), length 28 ^C 8 packets captured 8 packets received by filter 0 packets dropped by kernel
-
在router网络命名空间的gw10网卡上抓包
[root@localhost ~]# ip netns exec router tcpdump -i gw10 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gw10, link-type EN10MB (Ethernet), capture size 262144 bytes 00:44:15.880134 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 112, length 64 00:44:15.880194 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 112, length 64 00:44:16.881202 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 113, length 64 00:44:16.881284 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 113, length 64 00:44:17.882050 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 114, length 64 00:44:17.882131 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 114, length 64 00:44:17.885868 ARP, Request who-has localhost.localdomain tell 192.168.1.2, length 28 00:44:17.885901 ARP, Reply localhost.localdomain is-at 82:13:c8:4c:87:90 (oui Unknown), length 28 ^C 8 packets captured 8 packets received by filter 0 packets dropped by kernel
-
在router网络命名空间的gw12网卡上抓包
[root@localhost ~]# ip netns exec router tcpdump -i gw12 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gw12, link-type EN10MB (Ethernet), capture size 262144 bytes 00:44:45.917356 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 142, length 64 00:44:45.917415 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 142, length 64 00:44:46.917388 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 143, length 64 00:44:46.917450 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 143, length 64 00:44:47.917406 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 144, length 64 00:44:47.917444 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 144, length 64 ^C 6 packets captured 6 packets received by filter 0 packets dropped by kernel
-
在br4上抓包
[root@localhost ~]# tcpdump -i br4 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br4, link-type EN10MB (Ethernet), capture size 262144 bytes 00:45:40.280658 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 196, length 64 00:45:40.280720 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 196, length 64 00:45:41.277775 ARP, Request who-has 192.168.3.1 tell 192.168.3.5, length 28 00:45:41.278453 ARP, Reply 192.168.3.1 is-at 3a:2b:e5:c5:7e:54 (oui Unknown), length 28 00:45:41.280192 IP 192.168.1.2 > 192.168.3.5: ICMP echo request, id 58894, seq 197, length 64 00:45:41.280237 IP 192.168.3.5 > 192.168.1.2: ICMP echo reply, id 58894, seq 197, length 64 ^C 6 packets captured 6 packets received by filter 0 packets dropped by kernel
-
在ns42上抓包
[root@localhost ~]# ip netns exec ns42 tcpdump -i ns42-br4 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ns42-br4, link-type EN10MB (Ethernet), capture size 262144 bytes 00:46:42.345072 IP 192.168.1.2 > localhost.localdomain: ICMP echo request, id 58894, seq 258, length 64 00:46:42.345102 IP localhost.localdomain > 192.168.1.2: ICMP echo reply, id 58894, seq 258, length 64 00:46:42.346550 IP localhost.localdomain.38750 > 192.168.202.2.domain: 45169+ PTR? 5.3.168.192.in-addr.arpa. (42) 00:46:42.346612 IP gateway > localhost.localdomain: ICMP net 192.168.202.2 unreachable, length 78 00:46:42.346678 IP localhost.localdomain.43252 > 192.168.202.2.domain: 45169+ PTR? 5.3.168.192.in-addr.arpa. (42) 00:46:42.346704 IP gateway > localhost.localdomain: ICMP net 192.168.202.2 unreachable, length 78
总体流程就是ns1->br1->br-ovs->router的gw10->router的gw12->br4->ns42
利用了router网络命名空间的转发功能
[root@localhost ~]# ovs-ofctl dump-flows br-ovs -O Openflow13
cookie=0x0, duration=2563.501s, table=0, n_packets=1038, n_bytes=97748, priority=50,in_port=veth01 actions=write_metadata:0x100000001/0x100000001,goto_table:60
cookie=0x0, duration=2563.477s, table=0, n_packets=0, n_bytes=0, priority=50,in_port=veth02 actions=write_metadata:0x100000002/0x100000002,goto_table:60
cookie=0x0, duration=2563.450s, table=0, n_packets=1097, n_bytes=104482, priority=50,in_port=veth03 actions=write_metadata:0x100000003/0x100000003,goto_table:60
cookie=0x0, duration=2563.422s, table=0, n_packets=2129, n_bytes=202154, priority=50,in_port=veth04 actions=write_metadata:0x100000003/0x100000003,goto_table:60
cookie=0x0, duration=2563.397s, table=0, n_packets=1037, n_bytes=98070, priority=50,in_port=gw00 actions=write_metadata:0x100000001/0x100000001,goto_table:60
cookie=0x0, duration=2563.369s, table=0, n_packets=0, n_bytes=0, priority=50,in_port=gw01 actions=write_metadata:0x100000002/0x100000002,goto_table:60
cookie=0x0, duration=2563.345s, table=0, n_packets=1058, n_bytes=99936, priority=50,in_port=gw02 actions=write_metadata:0x100000003/0x100000003,goto_table:60
cookie=0x0, duration=2563.314s, table=60, n_packets=2, n_bytes=84, priority=50,arp,metadata=0x100000001,dl_dst=ff:ff:ff:ff:ff:ff actions=group:1
cookie=0x0, duration=2563.290s, table=60, n_packets=0, n_bytes=0, priority=50,arp,metadata=0x100000002,dl_dst=ff:ff:ff:ff:ff:ff actions=group:2
cookie=0x0, duration=2563.262s, table=60, n_packets=2, n_bytes=84, priority=50,arp,metadata=0x100000003,dl_dst=ff:ff:ff:ff:ff:ff actions=group:3
cookie=0x0, duration=2563.239s, table=60, n_packets=6355, n_bytes=602222, priority=0 actions=goto_table:80
cookie=0x0, duration=2563.211s, table=80, n_packets=1097, n_bytes=104482, priority=100,dl_dst=6a:c0:40:84:2e:67 actions=set_field:0x3->reg11,goto_table:253
cookie=0x0, duration=2563.186s, table=80, n_packets=0, n_bytes=0, priority=100,dl_dst=8e:e6:d4:63:1a:86 actions=set_field:0x3->reg11,goto_table:253
cookie=0x0, duration=2563.159s, table=80, n_packets=1135, n_bytes=108292, priority=100,dl_dst=36:a1:21:19:f4:fb actions=set_field:0x4->reg11,goto_table:253
cookie=0x0, duration=2563.133s, table=80, n_packets=989, n_bytes=93816, priority=100,dl_dst=3e:97:f8:fb:90:22 actions=set_field:0x4->reg11,goto_table:253
cookie=0x0, duration=2563.109s, table=80, n_packets=0, n_bytes=0, priority=100,dl_dst=72:84:48:54:3c:fc actions=set_field:0x2->reg11,goto_table:253
cookie=0x0, duration=2563.079s, table=80, n_packets=0, n_bytes=0, priority=100,dl_dst=8a:f9:bc:a9:55:8a actions=set_field:0x2->reg11,goto_table:253
cookie=0x0, duration=2563.052s, table=80, n_packets=14, n_bytes=1260, priority=100,dl_dst=1e:63:a2:be:11:8e actions=set_field:0x1->reg11,goto_table:253
cookie=0x0, duration=2563.028s, table=80, n_packets=1023, n_bytes=96810, priority=100,dl_dst=9a:a8:4f:89:88:46 actions=set_field:0x1->reg11,goto_table:253
cookie=0x0, duration=2563.003s, table=80, n_packets=1036, n_bytes=97664, priority=100,dl_dst=82:13:c8:4c:87:90 actions=set_field:0x5->reg11,goto_table:253
cookie=0x0, duration=2562.979s, table=80, n_packets=0, n_bytes=0, priority=100,dl_dst=6e:6d:31:a2:36:10 actions=set_field:0x6->reg11,goto_table:253
cookie=0x0, duration=2562.519s, table=80, n_packets=1061, n_bytes=99898, priority=100,dl_dst=3a:2b:e5:c5:7e:54 actions=set_field:0x7->reg11,goto_table:253
cookie=0x0, duration=2547.441s, table=253, n_packets=1037, n_bytes=98070, priority=50,reg11=0x1 actions=output:veth01
cookie=0x0, duration=2547.415s, table=253, n_packets=0, n_bytes=0, priority=50,reg11=0x2 actions=output:veth02
cookie=0x0, duration=2547.389s, table=253, n_packets=1097, n_bytes=104482, priority=50,reg11=0x3 actions=output:veth03
cookie=0x0, duration=2547.365s, table=253, n_packets=2124, n_bytes=202108, priority=50,reg11=0x4 actions=output:veth04
cookie=0x0, duration=2547.342s, table=253, n_packets=1036, n_bytes=97664, priority=50,reg11=0x5 actions=output:gw00
cookie=0x0, duration=2547.317s, table=253, n_packets=0, n_bytes=0, priority=50,reg11=0x6 actions=output:gw01
cookie=0x0, duration=2546.841s, table=253, n_packets=1061, n_bytes=99898, priority=50,reg11=0x7 actions=output:gw02