>> Then how can I disable the default behavior of ovs? When you create your bridge, you can set it to secure mode. This automatically disables NORMAL/default behavior. An example is: ovs-vsctl -- --may-exist add-br br-int\ -- set bridge br-int other-config:disable-in-band=true\ -- set bridge br-int fail-mode=secure