Comment 5 for bug 1182629

Hi Robert,

I think the issue is that the python-quantumclient isn't printing ethertype for example if you do this it looks more clear what the rules do:

http://codepad.org/T9sichU8

Currently security groups allow all dhcp traffic in. I agree this is not ideal but this is the same way security groups were done in nova so we choose to do the same (sure we should probably change this).

The second thing is that in order to use security groups you need ip spoofing enabled. The reason for this is if ip spoofing was not enabled an instance could change it's source ip in order to get around a security group rule. IMO displaying the ip spoofing rules does us no good.