I run some scenarios with ML2/OVN and ML2/OVS (in all tests security-group has no rule) With the OVN backend, when port security is enabled I can NOT watch the unicast traffic of other instances by tcpdump, but when port security is disabled I can watch other unicast traffic for other instances. I also run the same scenarios when the backend is Openvswitch only (not OVN) I can watch unicast traffic of other instances (enabling or disabling port security has no impact). Is there any link or reference that explicitly explains this issue and the impact of OVN in OpenStack for dropping other traffic? I dump flow rules from openvswitch and compare them, and I'm pretty sure that the OVN adds some rules to drop other unicast traffic. Can I drop the unicast traffic of other instances in Openvswitch when I do not use OVN as the backend? (automatically or by configuration)