[ovs-discuss] Re:Re: [HELP] Question about icmp pkt marked Invalid by userspace conntrack

Darrell Ball dlu998 at gmail.com
Mon Nov 11 15:59:10 UTC 2019

Hi Timo

On Sun, Nov 10, 2019 at 11:58 PM txfh2007 <txfh2007 at aliyun.com> wrote:

> Hi Darrell:
>     I have tried to manual set flow table and meter action, to arrange
> meter action at the end of the flow pipeline(just before the output
> action), and delete conntrack related actions. But the iperf result is also
> around 800Mbps(meter rate is 1Gbps as below).
>     Should I print any message to verify that userspace meter works as
> expected ?
> ovs-ofctl dump-meters br-int -O openflow13
> OFPST_METER_CONFIG reply (OF1.3) (xid=0x2):
> meter=1 kbps burst stats bands=
> type=drop rate=1000000 burst_size=1200000
>  ovs-appctl dpif/dump-flows br-int
> recirc_id(0),in_port(5),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no),
> packets:570308, bytes:817648729, used:0.191s, flags:SP., actions:meter(0),3
> recirc_id(0),in_port(3),packet_type(ns=0,id=0),eth_type(0x0800),ipv4(frag=no),
> packets:291956, bytes:19551792, used:0.191s, flags:SP., actions:5

Just to recap here:

The test is sending b/w 2 VMs attached to the same host.

Now you are rechecking the base case of the test by removing the conntrack
rules and are applying a meter rule in one direction only.
However, the same problem is observed where 0.8 Gbps is seen vs 1 Gbps
meter setting
Without meter, you can get 5 Gbps.

1/ To investigate, try explicitly setting the burst size high to take
burstiness out as a factor.
2/ Also try other meter rates which might help see where the issue is.

> ------------------------------------------------------------------
> :txfh2007 <txfh2007 at aliyun.com>
> :Ben Pfaff <blp at ovn.org>; ovs-discuss <ovs-discuss at openvswitch.org>
> :Re: [ovs-discuss] Re:Re: [HELP] Question about icmp pkt marked Invalid by
> userspace conntrack
> Hi Timo
> On Wed, Nov 6, 2019 at 9:37 PM txfh2007 <txfh2007 at aliyun.com> wrote:
> Hi Darrell:
>     Sorry, I forgot to tell you the attached flow is based on VM tx
> direction rate limit. So the datapath action order is conntrack -> meter ->
> forward decision -> output, For the  VM rx direction rate limit, the
> datapath flow is as below, please help to check, thank you!
> For both directions, I think you want to apply the flow meter at the end
> of the pipeline.
> Can you do that and then check the numbers again.
>    Also, for the same flow table and meter configuration, the kernel
> datapath rate limit is more accurate than userspace datapath.
> For VM rx direction rate limit:
> ct_state(-new+est-rel-rpl-inv+trk),ct_label(0/0x1),recirc_id(0x29),in_port(5),packet_type(ns=0,id=0),eth(src=fa:16:3e:33:02:d8,dst=fa:16:3e:12:d7:77),eth_type(0x0800),ipv4(dst=
> packets:1031455, bytes:1481163900, used:0.149s, flags:.,
> actions:ct(zone=4),recirc(0x2a)
> ct_state(-new+est-rel-rpl-inv+trk),ct_label(0/0x1),recirc_id(0x2a),in_port(5),packet_type(ns=0,id=0),eth(src=fa:16:3e:33:02:d8,dst=fa:16:3e:12:d7:77),eth_type(0x0800),ipv4(src=,dst=,proto=6,frag=no),
> packets:1685180, bytes:2415638857, used:0.118s, flags:P., actions:meter(1),6
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openvswitch.org/pipermail/ovs-discuss/attachments/20191111/8fa8b2d8/attachment.html>

More information about the discuss mailing list