I figured out how to do some more tracing/debugging of the vanishing NA packets, and it seems to be a mismatch between what actually happens in OVS (drop) and what OVN thinks should happening (forwarding). I'll walk you through it below. 1) First I capture an ICMPv6 NA packet that is dropped from the :a982 VM: $ tcpdump -XXvpnei tap8bdc141e-fe -Q in -c 1 icmp6[0] = 136 dropped privs to tcpdump tcpdump: listening on tap8bdc141e-fe, link-type EN10MB (Ethernet), snapshot length 262144 bytes 10:22:08.178527 fa:16:3e:9b:a9:82 > fa:16:3e:ad:9a:5e, ethertype IPv6 (0x86dd), length 78: (hlim 255, next-header ICMPv6 (58) payload length: 24) fe80::f816:3eff:fe9b:a982 > fe80::f816:3eff:fead:9a5e: [icmp6 sum ok] ICMP6, neighbor advertisement, length 24, tgt is fe80::f816:3eff:fe9b:a982, Flags [solicited] 0x0000: fa16 3ead 9a5e fa16 3e9b a982 86dd 6000 ..>..^..>.....`. 0x0010: 0000 0018 3aff fe80 0000 0000 0000 f816 ....:........... 0x0020: 3eff fe9b a982 fe80 0000 0000 0000 f816 >............... 0x0030: 3eff fead 9a5e 8800 ad9d 4000 0000 fe80 >....^....@..... 0x0040: 0000 0000 0000 f816 3eff fe9b a982 ........>..... 1 packet captured 1 packet received by filter 0 packets dropped by kernel 2) Then I determine the ofport attribute for the VM-facing tap interface: $ ovs-vsctl get Interface tap8bdc141e-fe ofport 15 3) Using the packet hex string + the ofport attribute found above, I can now do a OVS trace, which can then be run through OVN detrace to be annotated with additional information: $ ovs-appctl ofproto/trace br-int in_port=15 fa163ead9a5efa163e9ba98286dd6000000000183afffe80000000000000f8163efffe9ba982fe80000000000000f8163efffead9a5e8800ad9d40000000fe80000000000000f8163efffe9ba982 | ovn-detrace (…) Flow: icmp6,in_port=15,vlan_tci=0x0000,dl_src=fa:16:3e:9b:a9:82,dl_dst=fa:16:3e:ad:9a:5e,ipv6_src=fe80::f816:3eff:fe9b:a982,ipv6_dst=fe80::f816:3eff:fead:9a5e,ipv6_label=0x00000,nw_tos=0,nw_ecn=0,nw_ttl=255,nw_frag=no,icmp_type=136,icmp_code=0,nd_target=fe80::f816:3eff:fe9b:a982,nd_sll=00:00:00:00:00:00,nd_tll=00:00:00:00:00:00 bridge("br-int") ---------------- 0. in_port=15, priority 100, cookie 0x8a1ff59b set_field:0x46->reg13 set_field:0x45->reg11 set_field:0x44->reg12 set_field:0x26->metadata set_field:0x9->reg14 resubmit(,8) * Logical datapath: "neutron-7f71277c-aae0-4037-8392-2398a8be9929" (9c1b45e9-0135-4301-b7a8-4281e843e306) * Port Binding: logical_port "8bdc141e-fed6-4100-bf80-95a36c8a9b97", tunnel_key 9, chassis-name "d48404f8-e1b9-5184-bdda-bd7ce0ca1d58", chassis-str "node08" 8. metadata=0x26, priority 50, cookie 0x59f248ee set_field:0/0x1000->reg10 resubmit(,73) * Logical datapaths: * "neutron-b7a0e814-603b-4a7e-9bc2-c5a14752fcbf" (0486544d-1050-408d-936f-aaaa96c71df7) [ingress] * "neutron-4f34ef66-41ad-4393-a0e7-c46981d55740" (0ef0124f-4c01-481b-9bd8-e0cbdd60883b) [ingress] * "neutron-50ba6904-3111-43a3-8fe4-d2bb6d6d120c" (14741cc3-fe87-4605-b17a-72db8c9f46f9) [ingress] * "neutron-75c4c616-b079-42f2-bf62-c4049a16ac31" (155bf97f-55d0-40f3-9246-731983eb9fc5) [ingress] * "neutron-54578d02-3847-442c-adc0-1a7ad144ef05" (25e90264-92e7-4941-aafa-96b7f08764f5) [ingress] * "neutron-94c1dce8-4596-4572-b74f-2aa7322a9c60" (2aa8eaed-08f3-4c09-a1cf-45f63ef25c34) [ingress] * "neutron-e16f44ad-f1bf-460a-ae01-8411ac5ddb1d" (2bdf5db0-b727-45c9-a92a-f76bd06fa3ec) [ingress] * "neutron-006989a6-e074-49a2-9a7b-3d6d9cc2db19" (4281bb18-87de-4370-8069-50c5ed3f28d9) [ingress] * "neutron-9dd0f201-cbe4-49fb-9471-929d17427a53" (499e3bd4-9d1b-496e-96fe-cfe183f97779) [ingress] * "neutron-7be33e74-61e2-46d8-af66-17e3239242aa" (73738386-cf87-449d-a4bc-94aec32982d5) [ingress] * "neutron-a565e4a1-f1ad-4542-81ec-18ef0aa0785b" (73b62d01-d186-4202-bf49-7ac21818799e) [ingress] * "neutron-14fdd838-6d2c-45f5-8d51-a83c18296b1d" (74dd09bc-7788-45cf-b98f-b10341270e55) [ingress] * "neutron-7f71277c-aae0-4037-8392-2398a8be9929" (9c1b45e9-0135-4301-b7a8-4281e843e306) [ingress] * "neutron-ed25de24-adbb-43ad-8ba6-af3e61a87e24" (a1f78b44-5feb-4a44-8a58-54f51e7a1a1f) [ingress] * "neutron-5ceef8a4-41bc-4290-abb9-e87c7b76f838" (a2699df1-9dd3-4e47-b9d9-a93272a501ca) [ingress] * "neutron-a8a0f3b6-fce4-4bb1-8260-99eeb4d4f6c4" (b16f44e0-4547-41dd-a2d8-9afd8ec43400) [ingress] * "neutron-4927f255-77ac-45e0-b6d2-cfd006d25053" (b884ef2d-18b2-4d71-ab8b-b90ac60ea504) [ingress] * "neutron-e6ff1cc8-59d6-433e-ac9a-cdbe4293c2e9" (cc2845c5-acb8-438b-a68d-c8a4d66ce3e3) [ingress] * "neutron-2efc219d-b8c8-439e-a03e-a3b56d093b81" (e7fe57a1-011c-4cbc-bbc6-b869e451d3d5) [ingress] * "neutron-463c566f-5b08-4122-aaae-4c6cea9c90fc" (f2ce3b29-e67f-4753-81f9-3f2788a1c599) [ingress] * "neutron-c5da7807-c684-423c-813a-ffb946d48d3a" (f5685241-ce8b-4604-a50e-e7828cc188ec) [ingress] * Logical flow: table=0 (ls_in_check_port_sec), priority=50, match=(1), actions=(reg0[15] = check_in_port_sec(); next;) 73. ipv6,reg14=0x9,metadata=0x26,dl_src=fa:16:3e:9b:a9:82,ipv6_src=fe80::f816:3eff:fe9b:a982, priority 90, cookie 0x8a1ff59b resubmit(,74) * Logical datapath: "neutron-7f71277c-aae0-4037-8392-2398a8be9929" (9c1b45e9-0135-4301-b7a8-4281e843e306) * Port Binding: logical_port "8bdc141e-fed6-4100-bf80-95a36c8a9b97", tunnel_key 9, chassis-name "d48404f8-e1b9-5184-bdda-bd7ce0ca1d58", chassis-str "node08" 74. icmp6,reg14=0x9,metadata=0x26,nw_ttl=255,icmp_type=136, priority 80, cookie 0x8a1ff59b set_field:0x1000/0x1000->reg10 move:NXM_NX_REG10[12]->NXM_NX_XXREG0[111] -> NXM_NX_XXREG0[111] is now 0x1 resubmit(,9) * Logical datapath: "neutron-7f71277c-aae0-4037-8392-2398a8be9929" (9c1b45e9-0135-4301-b7a8-4281e843e306) * Port Binding: logical_port "8bdc141e-fed6-4100-bf80-95a36c8a9b97", tunnel_key 9, chassis-name "d48404f8-e1b9-5184-bdda-bd7ce0ca1d58", chassis-str "node08" 9. reg0=0x8000/0x8000,metadata=0x26, priority 50, cookie 0x8d61d193 drop * Logical datapaths: * "neutron-b7a0e814-603b-4a7e-9bc2-c5a14752fcbf" (0486544d-1050-408d-936f-aaaa96c71df7) [ingress] * "neutron-4f34ef66-41ad-4393-a0e7-c46981d55740" (0ef0124f-4c01-481b-9bd8-e0cbdd60883b) [ingress] * "neutron-50ba6904-3111-43a3-8fe4-d2bb6d6d120c" (14741cc3-fe87-4605-b17a-72db8c9f46f9) [ingress] * "neutron-75c4c616-b079-42f2-bf62-c4049a16ac31" (155bf97f-55d0-40f3-9246-731983eb9fc5) [ingress] * "neutron-54578d02-3847-442c-adc0-1a7ad144ef05" (25e90264-92e7-4941-aafa-96b7f08764f5) [ingress] * "neutron-94c1dce8-4596-4572-b74f-2aa7322a9c60" (2aa8eaed-08f3-4c09-a1cf-45f63ef25c34) [ingress] * "neutron-e16f44ad-f1bf-460a-ae01-8411ac5ddb1d" (2bdf5db0-b727-45c9-a92a-f76bd06fa3ec) [ingress] * "neutron-006989a6-e074-49a2-9a7b-3d6d9cc2db19" (4281bb18-87de-4370-8069-50c5ed3f28d9) [ingress] * "neutron-9dd0f201-cbe4-49fb-9471-929d17427a53" (499e3bd4-9d1b-496e-96fe-cfe183f97779) [ingress] * "neutron-7be33e74-61e2-46d8-af66-17e3239242aa" (73738386-cf87-449d-a4bc-94aec32982d5) [ingress] * "neutron-a565e4a1-f1ad-4542-81ec-18ef0aa0785b" (73b62d01-d186-4202-bf49-7ac21818799e) [ingress] * "neutron-14fdd838-6d2c-45f5-8d51-a83c18296b1d" (74dd09bc-7788-45cf-b98f-b10341270e55) [ingress] * "neutron-7f71277c-aae0-4037-8392-2398a8be9929" (9c1b45e9-0135-4301-b7a8-4281e843e306) [ingress] * "neutron-ed25de24-adbb-43ad-8ba6-af3e61a87e24" (a1f78b44-5feb-4a44-8a58-54f51e7a1a1f) [ingress] * "neutron-5ceef8a4-41bc-4290-abb9-e87c7b76f838" (a2699df1-9dd3-4e47-b9d9-a93272a501ca) [ingress] * "neutron-a8a0f3b6-fce4-4bb1-8260-99eeb4d4f6c4" (b16f44e0-4547-41dd-a2d8-9afd8ec43400) [ingress] * "neutron-4927f255-77ac-45e0-b6d2-cfd006d25053" (b884ef2d-18b2-4d71-ab8b-b90ac60ea504) [ingress] * "neutron-e6ff1cc8-59d6-433e-ac9a-cdbe4293c2e9" (cc2845c5-acb8-438b-a68d-c8a4d66ce3e3) [ingress] * "neutron-2efc219d-b8c8-439e-a03e-a3b56d093b81" (e7fe57a1-011c-4cbc-bbc6-b869e451d3d5) [ingress] * "neutron-463c566f-5b08-4122-aaae-4c6cea9c90fc" (f2ce3b29-e67f-4753-81f9-3f2788a1c599) [ingress] * "neutron-c5da7807-c684-423c-813a-ffb946d48d3a" (f5685241-ce8b-4604-a50e-e7828cc188ec) [ingress] * Logical flow: table=1 (ls_in_apply_port_sec), priority=50, match=(reg0[15] == 1), actions=(drop;) Final flow: icmp6,reg0=0x8000,reg10=0x1000,reg11=0x45,reg12=0x44,reg13=0x46,reg14=0x9,metadata=0x26,in_port=15,vlan_tci=0x0000,dl_src=fa:16:3e:9b:a9:82,dl_dst=fa:16:3e:ad:9a:5e,ipv6_src=fe80::f816:3eff:fe9b:a982,ipv6_dst=fe80::f816:3eff:fead:9a5e,ipv6_label=0x00000,nw_tos=0,nw_ecn=0,nw_ttl=255,nw_frag=no,icmp_type=136,icmp_code=0,nd_target=fe80::f816:3eff:fe9b:a982,nd_sll=00:00:00:00:00:00,nd_tll=00:00:00:00:00:00 Megaflow: recirc_id=0,eth,icmp6,in_port=15,dl_src=fa:16:3e:9b:a9:82,ipv6_src=fe80::f816:3eff:fe9b:a982,nw_ttl=255,nw_frag=no,icmp_type=0x88/0xff,icmp_code=0x0/0xff,nd_target=fe80::f816:3eff:fe9b:a982,nd_tll=00:00:00:00:00:00 Datapath actions: drop Okay, so resulting action here is "drop". That corresponds with what I see actually happening. 4) Now I can compare the above result with what a OVN trace thinks ought to happen with such a packet: $ ovn-trace --summary neutron-7f71277c-aae0-4037-8392-2398a8be9929 'inport == "8bdc141e-fed6-4100-bf80-95a36c8a9b97" && eth.src == fa:16:3e:9b:a9:82 && eth.dst == fa:16:3e:ad:9a:5e && ip6.src == fe80::f816:3eff:fe9b:a982 && ip6.dst == fe80::f816:3eff:fead:9a5e && nd.target == fe80::f816:3eff:fe9b:a982 && nd_na' # icmp6,reg14=0x9,vlan_tci=0x0000,dl_src=fa:16:3e:9b:a9:82,dl_dst=fa:16:3e:ad:9a:5e,ipv6_src=fe80::f816:3eff:fe9b:a982,ipv6_dst=fe80::f816:3eff:fead:9a5e,ipv6_label=0x00000,nw_tos=0,nw_ecn=0,nw_ttl=255,nw_frag=no,icmp_type=136,icmp_code=0,nd_target=fe80::f816:3eff:fe9b:a982,nd_sll=00:00:00:00:00:00,nd_tll=00:00:00:00:00:00 ingress(dp="testnetwork", inport="8bdc14") { reg0[15] = check_in_port_sec(); next; next; next; reg0[8] = 1; reg0[9] = 1; next; next; next; outport = "aeb23a"; output; egress(dp="testnetwork", inport="8bdc14", outport="aeb23a") { next; next; reg0[8] = 1; reg0[9] = 1; next; next; reg0[15] = check_out_port_sec(); next; output; /* output to "aeb23a", type "" */; }; }; Result: output to port aeb23a. That is the expected output port, i.e., the one belonging to the test VM the NA is destined for (fa:16:3e:ad:9a:5e). There seems to be a mismatch here. OVS seems to be programmed not according to OVN's intentions. Agreed? Let me know if you think this bug report belongs in the OVN bug tracker instead of here, and I will be happy to re-file it there.