ovs结合netns配置端口镜像初试

前言

之前应用ovs都是在openwrt配置下桥，以及一些flow的应用。之前也大致了解了下netns，想着把ovs和netns结合用一下。本次主要通过ovs、netns配置端口镜像，然后抓包验证镜像功能。
OVS端口镜像是一项网络管理技术，它用于复制一个或多个网络端口的流量，并将复制的流量发送到目标端口，以便进行监视、分析或其他网络管理任务。

例子

ovs创建一个网桥，三个内部端口，再创建三个netns，分别将三个端口加入netns中，其中两个配置ip，第三个作其中一个镜像，然后抓包验证流。

            +-----------------------+
            |                       |
            |      br-dd (OVS)      |
            |                       |
            +-----------------------+
                  |       |       |
                vnet0   vnet1   vnet2
               1.0.0.1 1.0.0.2
                  |       |       |
                  |       |       |
              +-------+ +-------+ +-------+
              | ns0   | | ns1   | | ns2   |
              |       | |       | |       |
              +-------+ +-------+ +-------+

配置

# 创建网桥br-dd
ovs-vsctl add-br br-dd

# 添加三个内部端口:vnet0 vnet1 vnet2
ovs-vsctl add-port br-dd vnet0 -- set Interface vnet0 type=internal
ovs-vsctl add-port br-dd vnet1 -- set Interface vnet1 type=internal
ovs-vsctl add-port br-dd vnet2 -- set Interface vnet2 type=internal

# 添加三个netns:ns0 ns1 ns2
ip netns add ns0
ip netns add ns1
ip netns add ns2

# 将三个内部端口分别移动到netns中
ip link set vnet0 netns ns0
ip link set vnet1 netns ns1
ip link set vnet2 netns ns2

# 启动三个端口
ip netns exec ns0 ip link set vnet0 up
ip netns exec ns1 ip link set vnet1 up
ip netns exec ns2 ip link set vnet2 up


# 配置其中两个接口vnet0 vnet1的IP
ip netns exec ns0 ip addr add 1.0.0.1/24 dev vnet0
ip netns exec ns1 ip addr add 1.0.0.2/24 dev vnet1

# 配置镜像,从vnet1发送和接收的所有数据流量都会被复制到vnet2，以便进行监控或分析
ovs-vsctl -- set Bridge br-dd mirrors=@m \
 -- --id=@vnet1 get Port vnet1 \
 -- --id=@vnet2 get Port vnet2 \
 -- --id=@m create Mirror name=mirror_test select-dst-port=@vnet1 select-src-port=@vnet1 output-port=@vnet2

结果

• 查看ovs桥

  # ovs-vsctl show
  d38b473b-81af-4e7a-995c-a342bed62257
    Bridge br-dd
        Port vnet1
            Interface vnet1
                type: internal
        Port br-dd
            Interface br-dd
                type: internal
        Port vnet0
            Interface vnet0
                type: internal
        Port vnet2
            Interface vnet2
                type: internal

• 查看netns

  # ip netns ls
  ns2
  ns1
  ns0

• ping结果

从ns0中ping ns1中的vent1(1.0.0.2)

ip netns exec ns0 ping 1.0.0.2
PING 1.0.0.2 (1.0.0.2): 56 data bytes
64 bytes from 1.0.0.2: seq=0 ttl=64 time=0.640 ms
64 bytes from 1.0.0.2: seq=1 ttl=64 time=0.165 ms
64 bytes from 1.0.0.2: seq=2 ttl=64 time=0.171 ms
64 bytes from 1.0.0.2: seq=3 ttl=64 time=0.155 ms
64 bytes from 1.0.0.2: seq=4 ttl=64 time=0.164 ms
64 bytes from 1.0.0.2: seq=5 ttl=64 time=0.161 ms
64 bytes from 1.0.0.2: seq=6 ttl=64 time=0.155 ms
64 bytes from 1.0.0.2: seq=7 ttl=64 time=0.154 ms
64 bytes from 1.0.0.2: seq=8 ttl=64 time=0.156 ms
64 bytes from 1.0.0.2: seq=9 ttl=64 time=0.169 ms
64 bytes from 1.0.0.2: seq=10 ttl=64 time=0.161 ms
64 bytes from 1.0.0.2: seq=11 ttl=64 time=0.171 ms
64 bytes from 1.0.0.2: seq=12 ttl=64 time=0.164 ms
64 bytes from 1.0.0.2: seq=13 ttl=64 time=0.168 ms
64 bytes from 1.0.0.2: seq=14 ttl=64 time=0.150 ms
^C
--- 1.0.0.2 ping statistics ---
15 packets transmitted, 15 packets received, 0% packet loss
round-trip min/avg/max = 0.150/0.193/0.640 ms

• 在ns2上抓包

  ip netns exec ns2  tcpdump -i vnet2
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on vnet2, link-type EN10MB (Ethernet), capture size 262144 bytes
  16:33:01.705166 IP 1.0.0.1 > 1.0.0.2: ICMP echo request, id 14173, seq 0, length 64
  16:33:01.705360 IP 1.0.0.2 > 1.0.0.1: ICMP echo reply, id 14173, seq 0, length 64
  16:33:02.704960 IP 1.0.0.1 > 1.0.0.2: ICMP echo request, id 14173, seq 1, length 64
  16:33:02.705001 IP 1.0.0.2 > 1.0.0.1: ICMP echo reply, id 14173, seq 1, length 64
  16:33:03.705148 IP 1.0.0.1 > 1.0.0.2: ICMP echo request, id 14173, seq 2, length 64
  16:33:03.705187 IP 1.0.0.2 > 1.0.0.1: ICMP echo reply, id 14173, seq 2, length 64
  16:33:04.705320 IP 1.0.0.1 > 1.0.0.2: ICMP echo request, id 14173, seq 3, length 64
  16:33:04.705357 IP 1.0.0.2 > 1.0.0.1: ICMP echo reply, id 14173, seq 3, length 64
  16:33:05.705492 IP 1.0.0.1 > 1.0.0.2: ICMP echo request, id 14173, seq 4, length 64
  16:33:05.705530 IP 1.0.0.2 > 1.0.0.1: ICMP echo reply, id 14173, seq 4, length 64

命令

• 创建网桥
  ovs-vsctl add-br <bridge_name>
• 端口添加进网桥，并设置类型为internal
  ovs-vsctl add-port <bridge_name> <port_name> -- set Interface <port_name> type=internal

• 创建一个镜像规则，将一个端口的数据镜像到另一个端口

  • <bridge_name>：要操作的OVS网桥的名称。
  • <source_port>：要镜像的源端口。
  • <destination_port>：镜像数据流的目标端口。

  • <mirror_name>：镜像规则的名称。

    ovs-vsctl -- set Bridge <bridge_name> mirrors=@m \
    -- --id=@src_port get Port <source_port> \
    -- --id=@dst_port get Port <destination_port> \
    -- --id=@m create Mirror name=<mirror_name> \
    select-dst-port=@src_port select-src-port=@src_port output-port=@dst_port

• 查看镜像规则列表：
  ovs-vsctl list mirror
• 创建网络命名空间
  ip netns add <namespace_name>
• 删除镜像
  ovs-vsctl destroy Mirror <mirror_name>
• 查看存在的网络命名空间
  ip netns list
• 删除网络命名空间
  ip netns delete <namespace_name>
• 在网络空间执行命令
  ip netns exec <namespace_name> <command>

欢迎关注个人博客沟通交流