@pasuder, sorry for the delay. for your questions:
- could you collect packet capture from instance, please?
It is exactly the same as I observed from tap-xxx.
- could you check bridge type of br-int, please?
I don't know how to check the bridge type, I just use devstack to build an openvswitch environment. If you know how to check the bridge type of openvswitch device, pls let me know.
But I believe it is a switch not a bridge, or else, every thing will be flooded, not just the frame from qr-xxx to sg-xxx, right?
- what is the connection between tapxxx and qr-xxx?
tap-xxx connects to a linuxbridge then connects to br-int as qvo-xxx device. It is a typical openvswitch connection with iptables as securitygroup implementation. I believe you know what I am talking about :)
The ports on br-int are listed in [1]. So tap-xxx and qr-xxx can be seen as being connected to br-int.
Actually, I have a temporary workaround for it. The root cause is that the mac table in br-int doesn't have record for sg-xxx. You can check it by
@pasuder, sorry for the delay. for your questions:
- could you collect packet capture from instance, please?
It is exactly the same as I observed from tap-xxx.
- could you check bridge type of br-int, please?
I don't know how to check the bridge type, I just use devstack to build an openvswitch environment. If you know how to check the bridge type of openvswitch device, pls let me know.
But I believe it is a switch not a bridge, or else, every thing will be flooded, not just the frame from qr-xxx to sg-xxx, right?
- what is the connection between tapxxx and qr-xxx?
tap-xxx connects to a linuxbridge then connects to br-int as qvo-xxx device. It is a typical openvswitch connection with iptables as securitygroup implementation. I believe you know what I am talking about :)
The ports on br-int are listed in [1]. So tap-xxx and qr-xxx can be seen as being connected to br-int.
Actually, I have a temporary workaround for it. The root cause is that the mac table in br-int doesn't have record for sg-xxx. You can check it by
sudo ovs-appctl fdb/show br-int
The workaround is to add an openflow rule
sudo ovs-ofctl add-flow br-int "table= 60,priority= 5,dl_vlan= <local vlan id>,dl_src=<mac address of sg device> actions=NORMAL"
So, br-int will have the chance the learn the mac address of sg-xxx device. And frame between qr-xxx and sg-xxx will be unicast.
[1] http:// paste.openstack .org/show/ 720335/