Mikio Hara
151 lines
4.8 KiB
Plaintext
151 lines
4.8 KiB
Plaintext
.ds PN controller
|
|
|
|
.TH controller 8 "May 2008" "OpenFlow" "OpenFlow Manual"
|
|
|
|
.SH NAME
|
|
controller \- simple OpenFlow controller reference implementation
|
|
|
|
.SH SYNOPSIS
|
|
.B controller
|
|
[\fIoptions\fR] \fImethod\fR \fB[\fImethod\fR]\&...
|
|
|
|
.SH DESCRIPTION
|
|
A sample OpenFlow controller which functions as an L2 MAC-learning
|
|
switch or hub. \fBcontroller\fR can manage a remote datapath through
|
|
a secure channel (see \fBofprotocol(8)\fR). It can also connect directly
|
|
to a local datapath via Netlink.
|
|
|
|
\fBcontroller\fR controls one or more OpenFlow switches, specified as
|
|
one or more of the following OpenFlow connection methods:
|
|
|
|
.TP
|
|
\fBpssl:\fR[\fIport\fR]
|
|
Listens for SSL connections from remote OpenFlow switches on
|
|
\fIport\fR (default: 6633). The \fB--private-key\fR,
|
|
\fB--certificate\fR, and \fB--ca-cert\fR options are mandatory when
|
|
this form is used.
|
|
|
|
.TP
|
|
\fBptcp:\fR[\fIport\fR]
|
|
Listens for TCP connections from remote OpenFlow switches on
|
|
\fIport\fR (default: 6633).
|
|
|
|
.TP
|
|
\fBpunix:\fIfile\fR
|
|
Listens for connections from OpenFlow switches on the Unix domain
|
|
server socket named \fIfile\fR.
|
|
|
|
.TP
|
|
\fBnl:\fIdp_idx\fR
|
|
The local Netlink datapath numbered \fIdp_idx\fR, as configured with
|
|
.BR dpctl (8).
|
|
This form requires that the local host has the OpenFlow kernel
|
|
module for Linux loaded.
|
|
|
|
.TP
|
|
\fBssl:\fIhost\fR[\fB:\fIport\fR]
|
|
The specified SSL \fIport\fR (default: 6633) on the given remote
|
|
\fIhost\fR. The \fB--private-key\fR, \fB--certificate\fR, and
|
|
\fB--ca-cert\fR options are mandatory when this form is used.
|
|
|
|
.TP
|
|
\fBtcp:\fIhost\fR[\fB:\fIport\fR]
|
|
The specified TCP \fIport\fR (default: 6633) on the given remote
|
|
\fIhost\fR.
|
|
|
|
.TP
|
|
\fBunix:\fIfile\fR
|
|
The Unix domain server socket named \fIfile\fR.
|
|
|
|
.SH OPTIONS
|
|
.TP
|
|
\fB-p\fR, \fB--private-key=\fIprivkey.pem\fR
|
|
Specifies a PEM file containing the private key used as the switch's
|
|
identity for SSL connections to the controller.
|
|
|
|
.TP
|
|
\fB-c\fR, \fB--certificate=\fIcert.pem\fR
|
|
Specifies a PEM file containing a certificate, signed by the
|
|
controller's certificate authority (CA), that certifies the switch's
|
|
private key to identify a trustworthy switch.
|
|
|
|
.TP
|
|
\fB-C\fR, \fB--ca-cert=\fIswitch-cacert.pem\fR
|
|
Specifies a PEM file containing the CA certificate used to verify that
|
|
the switch is connected to a trustworthy controller.
|
|
|
|
.TP
|
|
\fB--peer-ca-cert=\fIcontroller-cacert.pem\fR
|
|
Specifies a PEM file that contains one or more additional certificates
|
|
to send to switches. \fIcontroller-cacert.pem\fR should be the CA
|
|
certificate used to sign the controller's own certificate (the
|
|
certificate specified on \fB-c\fR or \fB--certificate\fR).
|
|
|
|
This option is not useful in normal operation, because the switch must
|
|
already have the controller CA certificate for it to have any
|
|
confidence in the controller's identity. However, this option allows
|
|
a newly installed switch to obtain the controller CA certificate on
|
|
first boot using, e.g., the \fB--bootstrap-ca-cert\fR option to
|
|
\fBofprotocol\fR(8).
|
|
|
|
.TP
|
|
.BR \-n ", " \-\^\-noflow
|
|
By default, the controller sets up a flow in each OpenFlow switch
|
|
whenever it receives a packet whose destination is known due through
|
|
MAC learning. This option disables flow setup, so that every packet
|
|
in the network passes through the controller.
|
|
|
|
This option is most useful for debugging. It reduces switching
|
|
performance, so it should not be used in production.
|
|
|
|
.TP
|
|
\fB--max-idle=\fIsecs\fR|\fBpermanent\fR
|
|
Sets \fIsecs\fR as the number of seconds that a flow set up by the
|
|
controller will remain in the switch's flow table without any matching
|
|
packets being seen. If \fBpermanent\fR is specified, which is not
|
|
recommended, flows will never expire. The default is 60 seconds.
|
|
|
|
This option affects only flows set up by the OpenFlow controller. In
|
|
some configurations, the OpenFlow secure channel can set up some flows
|
|
on its own. To set the idle time for those flows, pass
|
|
\fB--max-idle\fR to \fBofprotocol\fR(8).
|
|
|
|
This option has no effect when \fB-n\fR (or \fB--noflow\fR) is in use
|
|
(because the controller does not set up flows in that case).
|
|
|
|
.TP
|
|
.BR \-H ", " \-\^\-hub
|
|
By default, the controller acts as an L2 MAC-learning switch. This
|
|
option changes its behavior to that of a hub that floods packets on
|
|
all but the incoming port.
|
|
|
|
If \fB-H\fR (or \fB--hub\fR) and \fB-n\fR (or \fB--noflow\fR) are used
|
|
together, then the cumulative effect is that every packet passes
|
|
through the controller and every packet is flooded.
|
|
|
|
This option is most useful for debugging. It reduces switching
|
|
performance, so it should not be used in production.
|
|
|
|
.so lib/daemon.man
|
|
.so lib/vlog.man
|
|
.so lib/common.man
|
|
|
|
.SH EXAMPLES
|
|
|
|
.TP
|
|
To connect directly to local datapath 0 over netlink (Linux only):
|
|
|
|
.B % controller nl:0
|
|
|
|
.TP
|
|
To bind locally to port 6633 (the default) and wait for incoming connections from OpenFlow switches:
|
|
|
|
.B % controller ptcp:
|
|
|
|
.SH "SEE ALSO"
|
|
|
|
.BR dpctl (8),
|
|
.BR ofprotocol (8),
|
|
.BR ofdatapath (8),
|
|
.BR vlogconf (8)
|