This is a material for discussion about the design of Tap-as-a-Service. (IRC meeting on 7/20/2016)

1. Copyright 2016 FUJITSU LABORATORIES LTD.
Cannot observe ingress packets
Kazuhiro Suzuki
2016/7/20
Fujitsu Laboratories Ltd.
0

2. We cannot observe ingress packets on Monitor
 Test Bet
 Flow entries for Ingress packets defined in br-int.
Copyright 2016 FUJITSU LABORATORIES LTD.
1. cookie=0x0, duration=601700.446s, table=0, n_packets=44,
n_bytes=1848, idle_age=65534, hard_age=65534,
priority=20,dl_vlan=1,dl_dst=01:00:00:00:00:00/01:00:00:00:
00:00 actions=NORMAL,mod_vlan_vid:3901,output:5
2. cookie=0x0, duration=599507.935s, table=0, n_packets=0,
n_bytes=0, idle_age=65534, hard_age=65534,
priority=20,dl_vlan=1,dl_dst=fa:16:3e:bd:77:8f
actions=NORMAL,mod_vlan_vid:3901,output:5
VM1Monitor VM0
MAC:fa:16:3e:bd:77:8f
br_int br_tapPort Mirroring
ping
5
1

3. We observed packets on Monitor VM
 When VM0 and VM1 are running on the same host, we can
observe only egress packets at the port of VM1, ingress
packets cannot be observed.
Copyright 2016 FUJITSU LABORATORIES LTD.
$ tcpdump -e -n -i eth1
06:23:18.062505 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.1.3 > 192.168.1.6:
ICMP echo reply, id 926, seq 12152, length 64
06:23:19.063943 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.1.3 > 192.168.1.6:
ICMP echo reply, id 926, seq 12153, length 64
VM1Monitor VM0
br_int br_tapPort Mirroring
ping
5
tcpdump
2

4. Copyright 2016 FUJITSU LABORATORIES LTD.
 We checked packets which go through VM0 port using
tcpdump
Packet observation in VM0
$ sudo tcpdump -n -e -i dummy0
14:52:57.774417 fa:16:3e:8c:54:e3 > fa:16:3e:bd:77:8f, ethertype 802.1Q
(0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.1.6 >
192.168.1.3: ICMP echo request, id 926, seq 10334, length 64
14:52:57.774874 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.1.3 >
192.168.1.6: ICMP echo reply, id 926, seq 10334, length 64
VM1Monitor VM0
br_int br_tapPort Mirroring
ping
5
tcpdump
3

5.  We also checked packets at VM1
 Both ingress packets observed at VM0 and VM1 have vlan id 1,
but the flow entry for ingress packets is not evaluated.
VM1Monitor VM0
br_int br_tapPort Mirroring
ping
5
Copyright 2016 FUJITSU LABORATORIES LTD.
Packet observation in VM1
$ sudo tcpdump -n -e -i dummy0
14:46:33.258666 fa:16:3e:8c:54:e3 > fa:16:3e:bd:77:8f, ethertype 802.1Q
(0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.1.6 > 192.168.1.3:
ICMP echo request, id 926, seq 9950, length 64
14:46:33.258901 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 1, p 0, ethertype IPv4, 192.168.1.3 > 192.168.1.6:
ICMP echo reply, id 926, seq 9950, length 64
tcpdump
4

6. We modified a flow entry of TapFlow
 We can observe both direction(egress and ingress) on Monitor
when “dl_vlan=1” is removed from the ingress flow entries.
Copyright 2016 FUJITSU LABORATORIES LTD.
$ tcpdump -e -n -i eth1
06:23:18.062505 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.1.3 >
192.168.1.6: ICMP echo reply, id 926, seq 12152, length 64
06:23:19.063943 fa:16:3e:bd:77:8f > fa:16:3e:8c:54:e3, ethertype 802.1Q
(0x8100), length 102: vlan 2, p 0, ethertype IPv4, 192.168.1.3 >
192.168.1.6: ICMP echo reply, id 926, seq 12153, length 64
VM1Monitor VM0
br_int br_tapPort Mirroring
ping
5
tcpdump
5