ovs-tcpdump8
Dump traffic from an open vswitch port using tcpdump
Usage
ovs-tcpdump -i
<port>
<tcpdump
options> ...
Overview
ovs-tcpdump creates switch mirror ports in the ovs-vswitchd daemon and executes tcpdump to listen against those ports. When the tcpdump instance exits, it then cleans up the mirror port it created.
ovs-tcpdump will not allow multiple mirrors for the same port. It has some logic to parse the current configuration and prevent duplicate mirrors.
The -i option may not appear multiple times.
It is important to note that under Linux-based kernels, tap devices do not receive packets unless the specific tuntap device has been opened by an application. This requires CAP_NET_ADMIN privileges, so the ovs-tcpdump command must be run as a user with such permissions (this is usually a super-user).
Options
- •
-
-hor--helpPrints a brief help message to the console.
- •
-
-Vor--versionPrints version information to the console.
- •
-
--db-sock <socket>
The Open vSwitch database socket connection string. The default is
unix:<rundir>/db.sock.
- •
-
--dump-cmd <command>
The command to run instead of
tcpdump.
- •
-
-ior--interfaceThe interface for which a mirror port should be created, and packets should be dumped.
- •
-
--mirror-toThe name of the interface which should be the destination of the mirrored packets. The default is
mi<port>.
- •
-
--spanIf specified, mirror all ports (optional).
- •
-
--filter <flow>
If specified, only mirror packets that match the provided OpenFlow filter. The available fields are documented in
ovs-fields(7).
Releases
5 releases since Debian 9 (Stretch); the text changed 4 times.
--db-sock until Debian 10 (Buster);
--dump-cmd until Debian 10 (Buster);
--help until Debian 10 (Buster);
--interface until Debian 10 (Buster);
--mirror-to until Debian 10 (Buster);
--version until Debian 10 (Buster);
-V until Debian 10 (Buster);
-h until Debian 10 (Buster);
-i until Debian 10 (Buster).