What it is¶
Open vSwitch is a programmable multilayer virtual switch, commonly used with KVM, containers, OpenStack, and OVN. It replaces the plain Linux bridge when you need OpenFlow rules, flexible VLAN handling, tunnels (VXLAN, GRE, Geneve), or central control. It pairs with network namespaces: namespaces or VMs plug into an OVS bridge with veth pairs.
Resources: project site, source, Wikipedia, an OVS cheat sheet.
Basic bridge and port management¶
sudo ovs-vsctl show # whole configuration
sudo ovs-vsctl add-br br0
sudo ovs-vsctl add-port br0 eth1
sudo ovs-vsctl list-ports br0
sudo ovs-vsctl del-port br0 eth1
sudo ovs-vsctl del-br br0
Tagging and trunking:
sudo ovs-vsctl add-port br0 vnet0 tag=20 # access port in VLAN 20
sudo ovs-vsctl add-port br0 trunk0 trunks=10,20,30 # trunk port
Information gathering¶
sudo ovs-vsctl list-ports br-ex # ports on a named bridge
sudo ovs-vsctl get Open_vSwitch . other_config # global settings (e.g. hw-offload)
sudo ovs-appctl dpctl/show # datapath and its ports
sudo ovs-appctl dpctl/dump-flows # kernel datapath flows
sudo ovs-ofctl dump-flows br0 # OpenFlow rules on a bridge
Hardware offload checks¶
When OVS flows are offloaded to a NIC (SR-IOV switchdev mode, TC flower), verify each layer:
sudo ovs-appctl dpctl/dump-flows type=offloaded # flows running in hardware
sudo ovs-appctl dpctl/dump-flows type=non-offloaded # flows handled in software
sudo devlink dev eswitch show pci/0000:af:00.1 # eswitch mode (switchdev vs legacy)
ethtool -k ens4f1 | grep tc-offload # NIC advertises TC offload
tc qdisc | grep ingress # ingress qdisc present on the port
ip -s -s link ls ens4f1_2 # counters on a representor port
If flows appear under non-offloaded when you expect hardware handling, check other_config:hw-offload=true, the eswitch mode, and that the driver supports the match/action combination.
Port mirroring¶
Mirroring copies traffic from chosen ports to an analysis port, ideal for tcpdump or Wireshark on a virtual switch. Walk-through: Configure a mirror port on Open vSwitch.
sudo ovs-vsctl -- set bridge br0 mirrors=@m \
-- --id=@src get port vnet0 \
-- --id=@dst get port mirror0 \
-- --id=@m create mirror name=m0 select-src-port=@src select-dst-port=@src output-port=@dst