Operating System: All
Platform: All

Used stable/beryllium code

Anil, any idea what this lldp spoofing warning is? Is this a new feature?

Sam,
I think there was a security vulnerability fix related to LLDP spoofing went in openflowplugin (a while back) and that fix is probably determining that LLDP spoof is happening.

Venkat, i never seen it in my environment, can you dump the rules on the OVS switches and see if there is drop rule installed or not.

venkat, i tried this locally with the same setup as yours and i am not seeing this issue. Can you please dump the output of "ovs-vsctl show" on all the nodes + flows installed on all the bridges on these nodes.

Anil,
Reted today also with the below setup

ODL1 -> Neutron Requests
ODL2/ODL3 for handling the OVS/Openflow

Still only ODL3 has the warning.

ovs-vsctl show

control node:
ubuntu@odl-os-control-node:~/devstack$ sudo ovs-vsctl show
7379aa64-0416-45e2-9531-351397cc742a
Manager "tcp:11.12.13.5:6640"
is_connected: true
Manager "tcp:11.12.13.4:6640"
is_connected: true
Bridge br-ex
Controller "tcp:11.12.13.5:6653"
is_connected: true
Controller "tcp:11.12.13.4:6653"
is_connected: true
fail_mode: secure
Port br-ex
Interface br-ex
type: internal
Port "eth2"
Interface "eth2"
Port patch-int
Interface patch-int
type: patch
options:

Bridge br-int
Controller "tcp:11.12.13.4:6653"
is_connected: true
Controller "tcp:11.12.13.5:6653"
is_connected: true
fail_mode: secure
Port br-int
Interface br-int
type: internal
Port "tapfe0a3251-16"
Interface "tapfe0a3251-16"
Port patch-ext
Interface patch-ext
type: patch
options:

Port "tap547166bc-d8"
Interface "tap547166bc-d8"
Port "vxlan-12.14.16.2"
Interface "vxlan-12.14.16.2"
type: vxlan
options:

ovs_version: "2.3.2"

Control Node
br-int lldp flows

cookie=0x0, duration=3298.189s, table=0, n_packets=908, n_bytes=101696, dl_type=0x88cc actions=CONTROLLER:65535

br-ex
ubuntu@odl-os-control-node:~/devstack$ sudo ovs-ofctl dump-flows br-ex -OOpenflow13
OFPST_FLOW reply (OF1.3) (xid=0x2):
cookie=0x0, duration=3374.887s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL
cookie=0x0, duration=3374.887s, table=0, n_packets=1070, n_bytes=119710, dl_type=0x88cc actions=CONTROLLER:65535

Compute Node

br-ex has no flows installed. br-int has the lldp flows as needed

Other clues:

Always happens in ODL3 when ODL2 and ODL3 are used as OVS Managers and Controllers for testing. the warning occurs every second.

ODL3 is the owner for all the entities, I think since br-ex is connected to public network, Maybe that is causing this error.
{
"entity-owners": {
"entity-type": [
{
"type": "ovsdb",
"entity": [
{
"id": "/network-topology:network-topology/network-topology:topology[network-topology:topology-id='ovsdb:1']/network-topology:node[network-topology:node-id='ovsdb://uuid/7379aa64-0416-45e2-9531-351397cc742a']",
"candidate": [

,

],
"owner": "member-3"
},
{
"id": "/network-topology:network-topology/network-topology:topology[network-topology:topology-id='ovsdb:1']/network-topology:node[network-topology:node-id='ovsdb://uuid/bf460c25-5849-4874-9758-4fcbafbf9f5e']",
"candidate": [

,

],
"owner": "member-3"
}
]
},
{
"type": "ovsdb-netvirt-provider",
"entity": [
{
"id": "/general-entity:entity[general-entity:name='ovsdb-netvirt-provider']",
"candidate": [

,

,

],
"owner": "member-3"
}
]
},
{
"type": "openflow",
"entity": [
{
"id": "/general-entity:entity[general-entity:name='openflow:49213346451329']",
"candidate": [

,

],
"owner": "member-3"
},
{
"id": "/general-entity:entity[general-entity:name='openflow:86756597698629']",
"candidate": [

,

],
"owner": "member-3"
},
{
"id": "/general-entity:entity[general-entity:name='openflow:49213351373018']",
"candidate": [

,

],
"owner": "member-3"
},

,
{
"id": "/general-entity:entity[general-entity:name='openflow:217913872071744']",
"candidate": [

,

],
"owner": "member-3"
},

]
},
{
"type": "ovsdb-southbound-provider",
"entity": [
{
"id": "/general-entity:entity[general-entity:name='ovsdb-southbound-provider']",
"candidate": [

,

,

],
"owner": "member-3"
}
]
}
]
}
}

(In reply to Venkatrangan Govindarajan from comment #8)
> Compute Node
>
> br-ex has no flows installed. br-int has the lldp flows as needed

Will need to add this as a seperate bug

In clustered environment, if two devices are owner by two different controller, LLDP packet sent by one controller node will go to another controller node through it's connected device. Currently we have a fix for security vulnerability fix that check if that LLDP packet was send by the same controller node and if not, it will spit the warning message reported in this bug. In 3 node cluster that's a very valid scenario, because different devices are connected to different controller node, but because of the existing security fix, it will spit warning message because that packet was not sent by the same controller. This requires a fix at the openflowplugin application level and it's not an easy fix from security perspective.

Net-virt don't usse any of the topology information because it's end host based solution, so we don't really want lldp speaker to send lldp packets to the switch. I disabled the lldp speaker for net-virt using the following patch

https://git.opendaylight.org/gerrit/#/c/34420/1