<p dir="ltr">> Now, how to configure "setageing" via Neutron ML2?</p>
<p dir="ltr">I don't think we have a nice place to put a hook for this right now. Feel free to file a request for enhancement bug (regular bug process with the tag 'rfe' and the use case in the body) and maybe we can get it addressed in a future version. </p>
<p dir="ltr">Cheers</p>
<div class="gmail_quote">On Jul 10, 2015 12:56 PM, "Martinx - ジェームズ" <<a href="mailto:thiagocmartinsc@gmail.com">thiagocmartinsc@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello Kevin!<div><br></div><div>First of all... THANK YOU SO MUCH!!! :-D<br><div class="gmail_extra"><br><div class="gmail_quote">On 10 July 2015 at 15:16, Kevin Benton <span dir="ltr"><<a href="mailto:blak111@gmail.com" target="_blank">blak111@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Am I correct in understanding that the traffic you are expecting to see is mirrored traffic not actually destined to the VM?</p></blockquote><div>Yes.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr"> </p>
<p dir="ltr">If so, linuxbridge is probably going to learn that the port all observed macs belong to is the physical one so nothing will be flooded on the bridge.</p></blockquote><div>Mmmm...</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">Try disabling mac learning on that bridge with the follow command so everything is flooded: brctl setageing <bridgename> 0<br></p></blockquote><div><br></div><div>Perfect! It worked like a charm!</div><div><br></div><div>Now, how to configure "setageing" via Neutron ML2? :-)</div><div><br></div><div>Thank you again!</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr"><br></p>
<div class="gmail_quote"><div><div>On Jul 10, 2015 1:01 AM, "Martinx - ジェームズ" <<a href="mailto:thiagocmartinsc@gmail.com" target="_blank">thiagocmartinsc@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Thank you James!<div><br></div><div>Listen, trying to resume my topology for you, my Instance have two interfaces.</div><div><br></div><div>1- eth0 - its default gateway - vxlan with dhcp (okay);</div><div>2- eth1 - vlan provider network (the one that doesn't work) (eth3 if instance have 4 vNIC).</div><div><br></div><div>I can access the Instance via ssh through its namespace router normally (or VNC Console).</div><div><br></div><div>For "eth1", the physical switch port sends a mirrored tagged vlan traffic to it. My instance just (wants to) consumes that traffic (untagged)... My instance is a kind of NFV (in "offline" mode)...</div><div><br></div><div>Do you still think that makes sense to capture the traffic simultaneously?</div><div><br></div><div>You're right, "eth1" have no IP, it is just UP, reading packets...</div><div><br></div><div>Thanks!</div><div>Thiago</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 10 July 2015 at 00:12, James Denton <span dir="ltr"><<a href="mailto:james.denton@rackspace.com" target="_blank">james.denton@rackspace.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Thanks, Thiago.<br>
</p>
<p><br>
</p>
<p>Do you mind running a capture across the 3 interfaces (eth, bridge, tap) simultaneously? In particular, traffic generated outside of the node that demonstrates connection attempts to your instance. It will be helpful to see if there are continuous ARP requests
without replies, or a reply and continuous TCP SYN packets and whatnot. On the tap interface you should only expect to see broadcast, multicast, and unicast traffic to the MAC address of the instance. Because the MAC addresses are masqueraded in those captures,
and they're not related, it's hard to tell what you're seeing. Do you mind not masking them this time around?<br>
</p>
<p><br>
</p>
<p>Also, what is the IP address of the instance? Seeing that this is an all-in-one, I'm guessing you didn't having issues with DHCP?<br>
</p>
<p><br>
</p>
<p>Thanks,<br>
</p>
<p>James<br>
</p>
<p><br>
</p>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Martinx - ジェームズ <<a href="mailto:thiagocmartinsc@gmail.com" target="_blank">thiagocmartinsc@gmail.com</a>><br>
<b>Sent:</b> Thursday, July 9, 2015 8:51 PM<br>
<b>To:</b> James Denton<br>
<b>Cc:</b> <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
<b>Subject:</b> Re: [Openstack] 99.5% of packets are disappearing somewhere between the Linux Bridge (brqxxxxzzzz-yy) and the tap (tapxxxxzzzz-yy).</font>
<div> </div>
</div><div><div>
<div>
<div dir="ltr">Hello James!
<div class="gmail_extra"><br>
<div class="gmail_quote">On 9 July 2015 at 11:17, James Denton <span dir="ltr"><<a href="mailto:james.denton@rackspace.com" target="_blank">james.denton@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word">Hi Thiago,<span>
<div><br>
</div>
<div>
<blockquote type="cite">
<div dir="ltr">
<div> * I can see the untagged packets arriving at "brq50b13311-fa", by using "tcpdump -eni brq50b13311-fa";</div>
</div>
</blockquote>
</div>
<div>
<div dir="ltr">
<div><br>
</div>
</div>
</div>
</span>
<div>Do you mind posting the packet capture from eth3 and the bridge on pastebin?</div>
</div>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>I don't mind, I'll just replace the public IPs before posting (and possibly MAC)...</div>
<div><br>
</div>
<div><br>
</div>
<div>* Actual traffic hitting physical "eth3" with VLAN tag (OK):</div>
<div><br>
</div>
<div><a href="http://paste.openstack.org/show/360214/" target="_blank">http://paste.openstack.org/show/360214/</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>* Actual traffic hitting "brq50b13311-fa" without tag (OK):</div>
<div><br>
</div>
<div><a href="http://paste.openstack.org/show/360249/" target="_blank">http://paste.openstack.org/show/360249/</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>* Actual traffic hitting "tap9a546be0-d6" without tag (BUGGED - missing packets):</div>
<div><br>
</div>
<div><a href="http://paste.openstack.org/show/360274/" target="_blank">http://paste.openstack.org/show/360274/</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>* Actual traffic hitting vNIC "eth3" without tag (BUGGED - missing packets):</div>
<div><br>
</div>
<div><a href="http://paste.openstack.org/show/360275/" target="_blank">http://paste.openstack.org/show/360275/</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>*** Only PVST, OSPF and ICMP are appearing inside the Instance (and its tap, of course) ***</div>
<div><br>
</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><span>
<div><br>
</div>
<div>
<blockquote type="cite">
<div dir="ltr">
<div> For example, I can not see the string "Cisco" while running "tcpdump -eni brq50b13311-fa | grep -i cisco", so, where those packets come from (that I'm seeing on tap9a546be0-d6 and within its instance - pastebin above) ???</div>
</div>
</blockquote>
</div>
<div>
<div dir="ltr">
<div><br>
</div>
</div>
</div>
</span>
<div>Those are multicast packets for PVST and OSPF from the switch and router, respectively. You might try filtering by MAC on the bridge instead of using grep to isolate those packets:</div>
<div><br>
</div>
<div>tcpdump -eni brq50b13311-fa ether dst 01:00:0c:cc:cc:cd</div>
<div><br>
</div>
<div>I would expect to see those packets on eth3 as well.</div>
</div>
</blockquote>
<div><br>
</div>
<div>You're absolutely right!</div>
<div><br>
</div>
<div>The PVST, OSPF (and very rare ICMP) are appearing @ eth3 too (with "vlan XXXX" tagged), my bad (that grep, "ether dst" is much better, tks).</div>
<div><br>
</div>
<div>Look, inside the Instance - vNIC eth3:</div>
<div><br>
</div>
<div>tcpdump -eni eth3</div>
<div><br>
</div>
<div><a href="http://paste.openstack.org/show/360127/" target="_blank">http://paste.openstack.org/show/360127/</a></div>
<div><br>
</div>
<div>
<div><br>
Only the PVST, OSPF and ICMP packets are hitting the tapxxxxzzzz-yy interface! As expected, I can see those packets inside of the Instance as well (Pastebin above).</div>
</div>
<div><br>
</div>
<div>Why TCP/UDP isn't passing?</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><span>
<div><br>
</div>
<div>
<blockquote type="cite">
<div dir="ltr">
<div> * I CAN NOT see the untagged packets arriving at "tap9a546be0-d6", by using "tcpdump -eni tap9a546be0-d6"!</div>
</div>
</blockquote>
</div>
</span>
<div>
<div dir="ltr">
<div><br>
</div>
<div>What do your security group rules look like? </div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>I have no Security Groups, no Firewall, no ipset...</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div style="font-size:12.8000001907349px">ML2 configuration contains:</div>
<div style="font-size:12.8000001907349px"><br>
</div>
<div style="font-size:12.8000001907349px"><a href="http://paste.openstack.org/show/356860/" target="_blank">http://paste.openstack.org/show/356860/</a><br>
</div>
</div>
<div><br>
</div>
<div> <br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>
<div dir="ltr">
<div><br>
</div>
<div><span>
<blockquote type="cite">
<div dir="ltr">
<div> What is driving me crazy is that, on top of this very same setup (including e1000 driver), but with different vlan tag, it works!</div>
</div>
</blockquote>
</span>
<div>
<div dir="ltr">
<div><br>
</div>
<div>Is it the same eth3 interface? You may want to avoid vlan 666, anyway. Never known those numbers to be lucky.</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Yes, very same eth3.</div>
<div><br>
</div>
<div>LOL... I just posted this number here, to not publish private data, actual VLAN ID is different. :-P</div>
<div><br>
</div>
<div>Why it works for "VLAN X", but not for "VLAN Y", is a mystery for me.</div>
<div><br>
</div>
<div>Thank you so much for your help!</div>
<div><br>
</div>
<div>I'm seeing some debugging progress here...</div>
<div><br>
</div>
<div>Hopping to get this fixed! It is very important for the project that I'm working on.</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>
<div dir="ltr">
<div>
<div>
<div dir="ltr"><span><font color="#888888">
<div><br>
</div>
</font></span></div>
</div>
</div>
</div>
</div>
<div><span><font color="#888888"><br>
<div>
<div>
<div>James</div>
</div>
</div>
</font></span></div>
</div>
</blockquote>
<div><br>
</div>
<div>Thiago</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>
<br></div></div><span>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></span></blockquote></div>
</blockquote></div><br></div></div></div>
</blockquote></div>