---

   ovs-vswitchd.conf.db    ( 5 )

---

Datapath TABLE

Configuration for a datapath within Open_vSwitch.

A datapath is responsible for providing the packet handling in Open vSwitch. There are two primary datapath implementations used by Open vSwitch: kernel and userspace. Kernel datapath implementations are available for Linux and Hyper-V, and selected as system in the datapath_type column of the Bridge table. The userspace datapath is used by DPDK and AF-XDP, and is selected as netdev in the datapath_type column of the Bridge table.

A datapath of a particular type is shared by all the bridges that use that datapath. Thus, configurations applied to this table affect all bridges that use this datapath.

Summary: datapath_version string ct_zones map of integer-CT_Zone pairs, key in range 0 to 65,535 Capabilities: capabilities : max_vlan_headers optional string, containing an integer, at least 0 capabilities : recirc optional string, either true or false capabilities : lb_output_action optional string, either true or false Connection-Tracking Capabilities: capabilities : ct_state optional string, either true or false capabilities : ct_state_nat optional string, either true or false capabilities : ct_zone optional string, either true or false capabilities : ct_mark optional string, either true or false capabilities : ct_label optional string, either true or false capabilities : ct_orig_tuple optional string, either true or false capabilities : ct_orig_tuple6 optional string, either true or false capabilities : masked_set_action optional string, either true or false capabilities : tnl_push_pop optional string, either true or false capabilities : ufid optional string, either true or false capabilities : trunc optional string, either true or false capabilities : nd_ext optional string, either true or false Clone Actions: capabilities : clone optional string, either true or false capabilities : sample_nesting optional string, containing an integer, at least 0 capabilities : ct_eventmask optional string, either true or false capabilities : ct_clear optional string, either true or false capabilities : max_hash_alg optional string, containing an integer, at least 0 capabilities : check_pkt_len optional string, either true or false capabilities : ct_timeout optional string, either true or false capabilities : explicit_drop_action optional string, either true or false capabilities : ct_zero_snat optional string, either true or false Common Columns: external_ids map of string-string pairs

Details: datapath_version: string Reports the version number of the Open vSwitch datapath in use. This allows management software to detect and report discrepancies between Open vSwitch userspace and datapath versions. (The ovs_version column in the Open_vSwitch reports the Open vSwitch userspace version.) The version reported depends on the datapath in use:

• When the kernel module included in the Open vSwitch source tree is used, this column reports the Open vSwitch version from which the module was taken.

• When the kernel module that is part of the upstream Linux kernel is used, this column reports <unknown>.

• When the datapath is built into the ovs-vswitchd binary, this column reports <built-in>. A built-in datapath is by definition the same version as the rest of the Open vSwitch userspace.

• Other datapaths (such as the Hyper-V kernel datapath) currently report <unknown>.

A version discrepancy between ovs-vswitchd and the datapath in use is not normally cause for alarm. The Open vSwitch kernel datapaths for Linux and Hyper-V, in particular, are designed for maximum inter-version compatibility: any userspace version works with with any kernel version. Some reasons do exist to insist on particular user/kernel pairings. First, newer kernel versions add new features, that can only be used by new- enough userspace, e.g. VXLAN tunneling requires certain minimal userspace and kernel versions. Second, as an extension to the first reason, some newer kernel versions add new features for enhancing performance that only new- enough userspace versions can take advantage of.

ct_zones: map of integer-CT_Zone pairs, key in range 0 to 65,535 Configuration for connection tracking zones. Each pair maps from a zone id to a configuration for that zone. Zone 0 applies to the default zone (ie, the one used if a zone is not specified in connection tracking-related OpenFlow matches and actions).

Capabilities:

The capabilities column reports a datapath's features. For the netdev datapath, the capabilities are fixed for a given version of Open vSwitch because this datapath is built into the ovs-vswitchd binary. The Linux kernel and Windows and other datapaths, which are external to OVS userspace, can vary in version and capabilities independently from ovs-vswitchd.

Some of these features indicate whether higher-level Open vSwitch features are available. For example, OpenFlow features for connection-tracking are available only when capabilities:ct_state is true. A controller that wishes to determine whether a feature is supported could, therefore, consult the relevant capabilities in this table. However, as a general rule, it is better for a controller to try to use the higher-level feature and use the result as an indication of support, since the low-level capabilities are more likely to shift over time than the high- level features that rely on them.

capabilities : max_vlan_headers: optional string, containing an integer, at least 0 Number of 802.1q VLAN headers supported by the datapath, as probed by the ovs-vswitchd slow path. If the datapath supports more VLAN headers than the slow path, this reports the slow path's limit. The value of other- config:vlan-limit in the Open_vSwitch table does not influence the number reported here.

capabilities : recirc: optional string, either true or false If this is true, then the datapath supports recirculation, specifically OVS_KEY_ATTR_RECIRC_ID. Recirculation enables higher performance for MPLS and active-active load balancing bonding modes.

capabilities : lb_output_action: optional string, either true or false If this is true, then the datapath supports optimized balance-tcp bond mode. This capability replaces existing hash and recirc actions with new action lb_output and avoids recirculation of packet in datapath. It is supported only for balance-tcp bond mode in netdev datapath. The new action gives higer performance by using bond buckets instead of post recirculation flows for selection of slave port from bond. By default this new action is disabled, however it can be enabled by setting other-config:lb-output-action in Port table.

Connection-Tracking Capabilities:

These capabilities are granular because Open vSwitch and its datapaths added support for connection tracking over several releases, with features added individually over that time.

capabilities : ct_state: optional string, either true or false If true, datapath supports OVS_KEY_ATTR_CT_STATE, which indicates support for the bits in the OpenFlow ct_state field (see ovs-fields(7)) other than snat and dnat, which have a separate capability.

If this is false, the datapath does not support connection-tracking at all and the remaining connection- tracking capabilities should all be false. In this case, Open vSwitch will reject flows that match on the ct_state field or use the ct action.

capabilities : ct_state_nat: optional string, either true or false If true, it means that the datapath supports the snat and dnat flags in the OpenFlow ct_state field. The ct_state capability must be true for this to make sense.

If false, Open vSwitch will reject flows that match on the snat or dnat bits in ct_state or use nat in the ct action.

capabilities : ct_zone: optional string, either true or false If true, datapath supports OVS_KEY_ATTR_CT_ZONE. If false, Open vSwitch rejects flows that match on the ct_zone field or that specify a nonzero zone or a zone field on the ct action.

capabilities : ct_mark: optional string, either true or false If true, datapath supports OVS_KEY_ATTR_CT_MARK. If false, Open vSwitch rejects flows that match on the ct_mark field or that set ct_mark in the ct action.

capabilities : ct_label: optional string, either true or false If true, datapath supports OVS_KEY_ATTR_CT_LABEL. If false, Open vSwitch rejects flows that match on the ct_label field or that set ct_label in the ct action.

capabilities : ct_orig_tuple: optional string, either true or false If true, the datapath supports matching the 5-tuple from the connection's original direction for IPv4 traffic. If false, Open vSwitch rejects flows that match on ct_nw_src or ct_nw_dst, that use the ct feature of the resubmit action, or the force keyword in the ct action. (The latter isn't tied to connection tracking support of original tuples in any technical way. They are conflated because all current datapaths implemented the two features at the same time.)

If this and capabilities:ct_orig_tuple6 are both false, Open vSwitch rejects flows that match on ct_nw_proto, ct_tp_src, or ct_tp_dst.

capabilities : ct_orig_tuple6: optional string, either true or false If true, the datapath supports matching the 5-tuple from the connection's original direction for IPv6 traffic. If false, Open vSwitch rejects flows that match on ct_ipv6_src or ct_ipv6_dst.

capabilities : masked_set_action: optional string, either true or false True if the datapath supports masked data in OVS_ACTION_ATTR_SET actions. Masked data can improve performance by allowing megaflows to match on fewer fields.

capabilities : tnl_push_pop: optional string, either true or false True if the datapath supports tnl_push and pop actions. This is a prerequisite for a datapath to support native tunneling.

capabilities : ufid: optional string, either true or false True if the datapath supports OVS_FLOW_ATTR_UFID. UFID support improves revalidation performance by transferring less data between the slow path and the datapath.

capabilities : trunc: optional string, either true or false True if the datapath supports OVS_ACTION_ATTR_TRUNC action. If false, the output action with packet truncation requires every packet to be sent to the Open vSwitch slow path, which is likely to make it too slow for mirroring traffic in bulk.

capabilities : nd_ext: optional string, either true or false True if the datapath supports OVS_KEY_ATTR_ND_EXTENSIONS to match on ICMPv6 "ND reserved" and "ND option type" header fields. If false, the datapath reports error if the feature is used.

Clone Actions:

When Open vSwitch translates actions from OpenFlow into the datapath representation, some of the datapath actions may modify the packet or have other side effects that later datapath actions can't undo. The OpenFlow ct, meter, output with truncation, encap, decap, and dec_nsh_ttl actions fall into this category. Often, this is not a problem because nothing later on needs the original packet.

Such actions can, however, occur in circumstances where the translation does require the original packet. For example, an OpenFlow output action might direct a packet to a patch port, which might in turn lead to a ct action that NATs the packet (which cannot be undone), and then afterward when control flow pops back across the patch port some other action might need to act on the original packet.

Open vSwitch has two different ways to implement this ``save and restore'' via datapath actions. These capabilities indicate which one Open vSwitch will choose. When neither is available, Open vSwitch simply fails in situations that require this feature.

capabilities : clone: optional string, either true or false True if the datapath supports OVS_ACTION_ATTR_CLONE action. This is the preferred option for saving and restoring packets, since it is intended for the purpose, but old datapaths do not support it. Open vSwitch will use it whenever it is available.

(The OpenFlow clone action does not always yield a OVS_ACTION_ATTR_CLONE action. It only does so when the datapath supports it and the clone brackets actions that otherwise cannot be undone.)

capabilities : sample_nesting: optional string, containing an integer, at least 0 Maximum level of nesting allowed by OVS_ACTION_ATTR_SAMPLE action. Open vSwitch misuses this action for saving and restoring packets when the datapath supports more than 3 levels of nesting and OVS_ACTION_ATTR_CLONE is not available.

capabilities : ct_eventmask: optional string, either true or false True if the datapath's OVS_ACTION_ATTR_CT action implements the OVS_CT_ATTR_EVENTMASK attribute. When this is true, Open vSwitch uses the event mask feature to limit the kinds of events reported to conntrack update listeners. When Open vSwitch doesn't limit the event mask, listeners receive reports of numerous usually unimportant events, such as TCP state machine changes, which can waste CPU time.

capabilities : ct_clear: optional string, either true or false True if the datapath supports OVS_ACTION_ATTR_CT_CLEAR action. If false, the OpenFlow ct_clear action has no effect on the datapath.

capabilities : max_hash_alg: optional string, containing an integer, at least 0 Highest supported dp_hash algorithm. This allows Open vSwitch to avoid requesting a packet hash that the datapath does not support.

capabilities : check_pkt_len: optional string, either true or false True if the datapath supports OVS_ACTION_ATTR_CHECK_PKT_LEN. If false, Open vSwitch implements the check_pkt_larger action by sending every packet through the Open vSwitch slow path, which is likely to make it too slow for handling traffic in bulk.

capabilities : ct_timeout: optional string, either true or false True if the datapath supports OVS_CT_ATTR_TIMEOUT in the OVS_ACTION_ATTR_CT action. If false, Open vswitch cannot implement timeout policies based on connection tracking zones, as configured through the CT_Timeout_Policy table.

capabilities : explicit_drop_action: optional string, either true or false True if the datapath supports OVS_ACTION_ATTR_DROP. If false, explicit drop action will not be sent to the datapath.

capabilities : ct_zero_snat: optional string, either true or false True if the datapath supports all-zero SNAT. This is a special case if the src IP address is configured as all 0's, i.e., nat(src=0.0.0.0). In this case, when a source port collision is detected during the commit, the source port will be translated to an ephemeral port. If there is no collision, no SNAT is performed.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.

external_ids: map of string-string pairs