How the OpenVswitch bridge works with SolusVM 2?

There is a public interface (referred to here as eth0) connected to the br-ext virtual switch, while virtual machines are linked to the br-int internal switch (or br-routed in the case of a routed network).

OpenFlow rules on the br-int switch enforce the network rules set in the Management Node (Settings -> Network Rules). The br-int and br-ext switches are interconnected through patch interfaces patch-br-int and patch-br-ext, enabling traffic from virtual machines to transition from br-int to br-ext, ultimately reaching the WAN.

Open vSwitch interfaces have unique characteristics, and not all Linux tools function reliably with them. For instance, netfilter (iptables, ebtables) is completely incompatible with OVS. Tcpdump may not always perform as expected with OVS — it might appear to work, but there is a significant chance it will not capture all traffic, since some of it may be fast-tracked in the kernel, bypassing tcpdump.

The command ovs-ofctl dump-flows br-int can be used to display flows for br-int, allowing the hit count for specific rules to be checked, which shows the activity on those rules.

Additionally, to monitor traffic across the entire bridge, a mirror interface can be created and tcpdump run on it to capture all traffic.

Below are the steps to configure a mirror port:

Step 1: Create a Mirror Port

Start by creating a dummy interface to serve as the mirror port:

sudo ip link add mir0 type dummy
sudo ip link set mir0 up

This creates a virtual interface named mir0.

Next, add it to the Open vSwitch bridge (replace BRIDGE_NAME with the desired bridge, such as br-int, br-ext, or br-routed):

sudo ovs-vsctl add-port BRIDGE_NAME mir0

Step 2: Configure Port Mirroring

Set up Open vSwitch to mirror traffic to mir0:

sudo ovs-vsctl \
-- --id=@mir0 get Port mir0 \
-- --id=@m create Mirror name=mirror0 select-all=true output-port=@mir0 \
-- set Bridge BRIDGE_NAME mirrors=@m

This configuration instructs OVS to duplicate all traffic passing through BRIDGE_NAME to the mir0 interface.

Step 3: Capture Traffic with tcpdump

Finally, tcpdump can be used on the mir0 interface to monitor the mirrored traffic:

sudo tcpdump -i mir0 -n -vv

• -i mir0 specifies the interface.
• -n disables hostname resolution for improved speed.
• -vv increases verbosity for more detailed output.