[ovs-discuss] Wireshark Dissector for Nicira Extensions

[Ben Pfaff]

OK, one sample attached.  I generated it with:

    make sandbox
    ovs-vsctl add-br br0
    ovs-vsctl set-controller br0 ptcp:
    ovs-ofctl show tcp:127.0.0.1

with tcpdump running against lo.  Here's the ofp-parse-pcap output:

    127.0.0.1.48140 > 127.0.0.1.6633:
    OFPT_HELLO (xid=0x1):
     version bitmap: 0x01

    127.0.0.1.6633 > 127.0.0.1.48140:
    OFPT_HELLO (xid=0x3):
     version bitmap: 0x01

    127.0.0.1.48140 > 127.0.0.1.6633:
    OFPT_FEATURES_REQUEST (xid=0x2):

    127.0.0.1.6633 > 127.0.0.1.48140:
    OFPT_FEATURES_REPLY (xid=0x2): dpid:0000369731881a43
    n_tables:254, n_buffers:256
    capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
    actions: OUTPUT SET_VLAN_VID SET_VLAN_PCP STRIP_VLAN SET_DL_SRC SET_DL_DST SET_NW_SRC SET_NW_DST SET_NW_TOS SET_TP_SRC SET_TP_DST ENQUEUE
     LOCAL(br0): addr:36:97:31:88:1a:43
         config:     0
         state:      0
         speed: 0 Mbps now, 0 Mbps max

    127.0.0.1.48141 > 127.0.0.1.6633:
    OFPT_HELLO (xid=0x3):
     version bitmap: 0x01

    127.0.0.1.6633 > 127.0.0.1.48141:
    OFPT_HELLO (xid=0x4):
     version bitmap: 0x01

    127.0.0.1.48141 > 127.0.0.1.6633:
    OFPT_GET_CONFIG_REQUEST (xid=0x4):

    127.0.0.1.6633 > 127.0.0.1.48141:
    OFPT_GET_CONFIG_REPLY (xid=0x4): frags=normal miss_send_len=0


On Sat, Feb 01, 2014 at 02:20:51PM -0500, Vasu Dasari wrote:
> Sure. I can look at this. Can you share a  sample pcap file with the
> scenario you outlined. I can make changes to the code to work in your
> and my pcap scenario.
> 
> Vasu
> 
> Sent from my iPhone
> 
> > On Feb 1, 2014, at 11:42 AM, Ben Pfaff <blp at nicira.com> wrote:
> >
> > I see.  Handling this case would require some extra code.  It also
> > raises the question of how to detect the start of an OpenFlow message
> > within a TCP stream, since any given TCP segment might begin in the
> > middle of an OpenFlow message.  One could ignore the problem, but then
> > there might be a lot of desynchronized garbage in the output stream.
> >
> > If you want to contribute a patch that works toward better handling
> > here, that would be nice.
> >
> >> On Sat, Feb 01, 2014 at 10:45:39AM -0500, Vasu Dasari wrote:
> >> No I do not have them. The pcap is an extract of OF packets alone. I am
> >> attaching the pcap I used here.
> >>
> >> -Vasu
> >>
> >>
> >>> On Sat, Feb 1, 2014 at 10:34 AM, Ben Pfaff <blp at nicira.com> wrote:
> >>>
> >>>> On Sat, Feb 01, 2014 at 08:46:27AM -0500, Vasu Dasari wrote:
> >>>> Thanks Ben. I was using 2.09. When I updated my git, I could see the
> >>>> command you suggested. But, unfortunately it was not working.
> >>>>
> >>>> vdasari at mininet:~$ ovs-ofctl ofp-parse-pcap of.pcap
> >>>> vdasari at mininet:~$
> >>>>
> >>>> On digging through the code, I found that there could be an issue with
> >>>> tcp_reader_run() or tcp_stream_lookup() and seq_no. "stream->seq_no is
> >>>> always 0". Once I force the code to return the "payload" by not checking
> >>>> for seq_no,, from tcp_reader_run() function, I could see the right
> >>>> output.And this logic is working for me. Probably there is something you
> >>>> had thought of regarding sequence numbers which I might be overlooking.
> >>>
> >>> Does your pcap file include the start of the TCP connection (the SYN and
> >>> SYN/ACK packets)?  I am not sure that I tested without that.
> >
> >
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcap
Type: application/octet-stream
Size: 4136 bytes
Desc: not available
URL: <http://openvswitch.org/pipermail/ovs-discuss/attachments/20140201/71fc078f/attachment-0002.obj>