Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in NB_Global options.

Mon, 05 Feb 2024 20:29:48 -0800 

Hi,

On 02/02/24 8:44 am, Mark Michelson wrote:

Hi Priyankar,
I'm not sure I understand the purpose of this patch. Even without this patch, you could configure whatever IP address you want in the ip_port_mappings as the source address for the health checks. I don't see anything in the code that restricts the IP to be within the subnet of the backend IP address. And even if there is such a restriction, I don't see anything in this patch that lifts that restriction.
There is no restriction from any OVN configuration point of view. But consider the scenario where the source IP in the ip_port_mappings belongs to the subnet outside of the backend VM. In that case, the backend VM will receive the health probe correctly, but when it tries to send the reply back to the probe, the VM tries to send packet to the router GW instead (since IP belongs to diff subnet than that of VM.). Hence, the reverse direction packet never reaches the OVN controller because dst-mac is set to the VM subnet's GW. 

Sample tcpdump on the Backend VM interface:
source ip:169.254.1.21, svc_monitor_mac = 52:89:2d:d7:12:d0, backend VM mac: 50:6b:8d:15:c9:0e, backend VM IP: 50.0.0.93
 04:23:18.080058 52:89:2d:d7:12:d0 > 50:6b:8d:15:c9:0e, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6), length 40)     169.254.1.21.54010 > 50.0.0.93.80: Flags [S], cksum 0xa921 (correct), seq 1988485367, win 65160, length 0 04:23:18.080512 50:6b:8d:15:c9:0e > e0:19:95:6d:37:58, ethertype IPv4 (0x0800), length 58: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)     50.0.0.93.80 > 169.254.1.21.54010: Flags [S.], cksum 0xdd8e (incorrect -> 0x7c1d), seq 2754347589, ack 1988485368, win 28040, options [mss 1402], length 0
Notice in the reply from the VM, the destination MAC is set to the default GW's MAC. Hence, it is not delivered to the ovn-controller.
With my patch, the user can set an IP address for the service monitor in NB_GLOBAL and use the same IP address in the ip-port-mappings. This way even if the dst mac is GW, as long as it is destined to svc monitor IP, it will be delivered to OVN controller.
The extra matches added in this patch (eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) don't make much sense to me either. When OVN sends a health check, the reply from the backend will have eth.dst set to the service monitor MAC address. Since the existing matches do not care what the destination IPv4 address is, the existing match should work fine. If there was something in the code that was dropping packets addressed to IP addresses outside the subnet of the configured load balancer backends, this patch doesn't appear to be doing anything to prevent such droppage.
We didn't notice this behaviour. The VM was sending the reply to the default gateway mac address.
And finally, if I'm mistaken about my above two points, then my final problem with this patch is that it only adds support for IPv4. I noticed that in the documentation for the Service_Monitor table in the southbound database, it claims that "Service monitoring for IPv6 services is not supported." And the "src_ip" field is documented as "Source IPv4 address to use in the service monitor packet." Unfortunately, these are inaccurate. IPv6 service monitoring was added as a feature about 3 months after the initial IPv4 service monitoring was added. Unfortunately, it looks as though we did not update the documentation, and we need to get this fixed. However, the northbound load balancer health check documentation makes it clear that IPv6 is supported, and the code also has support for IPv6 in it. So if I'm incorrect in the first two paragraphs and this option is really needed, then it needs to support IPv6 as well. 

ohh my bad. I forgot about IPv6. I'll add for it as well.

Thanks,
Priyankar



Thanks,
Mark Michelson

On 1/8/24 08:00, Priyankar Jain wrote:

This commit adds a new optional svc_monitor_ipv4 config in the NB_Global
options column. This IP address can be used to send the packets to the
OVN controller bypassing most of the logical switches pipelines.

Usage: Currently Load balancer health check requires a source IP address
to be allocated from the subnets where backends are present.
This change removes that requirement and instead user can give one IP
address for the system and set it in NB_Global:options:svc_monitor_ipv4.
While configuring the health check for the load balancer user can
provide this same IP while specifying the ip-port mappings.

Signed-off-by: Priyankar Jain <[email protected]>
---

Changes since v1:
  - Fixed one testcase in ovn-northd.at

---
  northd/en-sync-sb.c     | 10 +++++
  northd/northd.c         | 34 +++++++++++++--
  northd/northd.h         |  1 +
  northd/ovn-northd.8.xml | 40 +++++++++++------
  tests/ovn-northd.at     | 96 ++++++++++++++++++++---------------------
  5 files changed, 116 insertions(+), 65 deletions(-)

diff --git a/northd/en-sync-sb.c b/northd/en-sync-sb.c
index 2ec3bf54f..95e9ead29 100644
--- a/northd/en-sync-sb.c
+++ b/northd/en-sync-sb.c
@@ -372,6 +372,16 @@ sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,
      sync_addr_set(ovnsb_txn, "svc_monitor_mac", &svc, &sb_address_sets); 
      sorted_array_destroy(&svc);
  +    /* Service monitor IP. */
+    const char *svc_monitor_ip4 = northd_get_svc_monitor_ip4();
+    int num_addr = 0; /* Create empty address-set by default */
+    if (svc_monitor_ip4) {
+        num_addr = 1;
+    }
+    struct sorted_array ip_svc = sorted_array_create(&svc_monitor_ip4,
+                                                     num_addr, false);
+    sync_addr_set(ovnsb_txn, "svc_monitor_ip4", &ip_svc, &sb_address_sets); 
+
      /* sync port group generated address sets first */
      const struct nbrec_port_group *nb_port_group;
      NBREC_PORT_GROUP_TABLE_FOR_EACH (nb_port_group,
diff --git a/northd/northd.c b/northd/northd.c
index db3cd272e..f6d35143a 100644
--- a/northd/northd.c
+++ b/northd/northd.c
@@ -82,6 +82,7 @@ static bool use_common_zone = false;
  static char svc_monitor_mac[ETH_ADDR_STRLEN + 1];
  static struct eth_addr svc_monitor_mac_ea;
  +static char *svc_monitor_ip4 = NULL;
  /* If this option is 'true' northd will make use of ct.inv match fields. 
   * Otherwise, it will avoid using it.  The default is true. */
  static bool use_ct_inv_match = true;
@@ -7197,7 +7198,8 @@ build_pre_acls(struct ovn_datapath *od,
      ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 0, "1", "next;");
        ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110,
-                  "eth.dst == $svc_monitor_mac", "next;");
+                  "eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4", 
+                  "next;");
        ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110,
                    "eth.src == $svc_monitor_mac", "next;");
@@ -7370,7 +7372,8 @@ build_pre_lb(struct ovn_datapath *od, const struct shash *meter_groups, 
        /* Do not send service monitor packets to conntrack. */
      ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_LB, 110,
-                  "eth.dst == $svc_monitor_mac", "next;");
+                  "eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4", 
+                  "next;");
      ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_LB, 110,
                    "eth.src == $svc_monitor_mac", "next;");
  @@ -8238,7 +8241,7 @@ build_acls(struct ovn_datapath *od, const struct chassis_features *features,           /* Add a 34000 priority flow to advance the service monitor reply 
          * packets to skip applying ingress ACLs. */
          ovn_lflow_add(lflows, od, S_SWITCH_IN_ACL_EVAL, 34000,
-                    "eth.dst == $svc_monitor_mac",
+                    "eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4", 
                      REGBIT_ACL_VERDICT_ALLOW" = 1; next;");
            /* Add a 34000 priority flow to advance the service monitor packets @@ -10325,7 +10328,8 @@ build_lswitch_destination_lookup_bmcast(struct ovn_datapath *od, 
      ovs_assert(od->nbs);
        ovn_lflow_metered(lflows, od, S_SWITCH_IN_L2_LKUP, 110,
-                      "eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)", +                      "(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4)" 
+                      " && (tcp || icmp || icmp6)",
                        "handle_svc_check(inport);",
                        copp_meter_get(COPP_SVC_MONITOR, od->nbs->copp,
                                       meter_groups));
@@ -17891,6 +17895,22 @@ ovnnb_db_run(struct northd_input *input_data,
          smap_replace(&options, "svc_monitor_mac", svc_monitor_mac);
      }
  +    const char *monitor_ip4 = smap_get(&nb->options, "svc_monitor_ip4"); 
+    if (monitor_ip4) {
+        struct sockaddr_storage svc_mon_src_addr;
+        if (inet_parse_address(monitor_ip4, &svc_mon_src_addr)) {
+            struct ds src_ip_s = DS_EMPTY_INITIALIZER;
+            ss_format_address_nobracks(&svc_mon_src_addr, &src_ip_s);
+            svc_monitor_ip4 = ds_steal_cstr(&src_ip_s);
+        } else {
+            free(svc_monitor_ip4);
+            svc_monitor_ip4 = NULL;
+        }
+    } else {
+        free(svc_monitor_ip4);
+        svc_monitor_ip4 = NULL;
+    }
+
      char *max_tunid = xasprintf("%d",
get_ovn_max_dp_key_local(input_data->sbrec_chassis_table));
      smap_replace(&options, "max_tunid", max_tunid);
@@ -18326,3 +18346,9 @@ northd_get_datapath_for_port(const struct hmap *ls_ports, 
        return op ? op->od : NULL;
  }
+
+const char *
+northd_get_svc_monitor_ip4(void)
+{
+    return svc_monitor_ip4;
+}
diff --git a/northd/northd.h b/northd/northd.h
index 5be7b5384..a69b96bda 100644
--- a/northd/northd.h
+++ b/northd/northd.h
@@ -374,4 +374,5 @@ bool check_sb_lb_duplicates(const struct sbrec_load_balancer_table *); 
  void sync_pbs(struct ovsdb_idl_txn *, struct hmap *ls_ports);
  bool sync_pbs_for_northd_ls_changes(struct tracked_ls_changes *);
  +const char *northd_get_svc_monitor_ip4(void);
  #endif /* NORTHD_H */
diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml
index 98cf7adb4..c121fbb4c 100644
--- a/northd/ovn-northd.8.xml
+++ b/northd/ovn-northd.8.xml
@@ -448,11 +448,14 @@
        <p>
        This table also has a priority-110 flow with the match
-      <code>eth.dst == <var>E</var></code> for all logical switch
-      datapaths to move traffic to the next table. Where <var>E</var>
-      is the service monitor mac defined in the
+      <code>eth.dst == <var>E</var> || ip4.dst == <var>I</var></code> for all 
+      logical switch datapaths to move traffic to the next table. Where
+      <var>E</var> is the service monitor mac defined in the
        <ref column="options:svc_monitor_mac" table="NB_Global"
        db="OVN_Northbound"/> column of <ref table="NB_Global"
+      db="OVN_Northbound"/> table and <var>I</var> is the service monitor +      IP defined in the <ref column="options:svc_monitor_ip4" table="NB_Global" 
+      db="OVN_Northbound"/> column of <ref table="NB_Global"
        db="OVN_Northbound"/> table.
      </p>
  @@ -515,11 +518,14 @@
        <p>
        This table also has a priority-110 flow with the match
-      <code>eth.dst == <var>E</var></code> for all logical switch
-      datapaths to move traffic to the next table. Where <var>E</var>
-      is the service monitor mac defined in the
+      <code>eth.dst == <var>E</var> || ip4.dst == <var>I</var></code> for all 
+      logical switch datapaths to move traffic to the next table. Where
+      <var>E</var> is the service monitor mac defined in the
        <ref column="options:svc_monitor_mac" table="NB_Global"
        db="OVN_Northbound"/> column of <ref table="NB_Global"
+      db="OVN_Northbound"/> table and <var>I</var> is the service monitor +      IP defined in the <ref column="options:svc_monitor_ip4" table="NB_Global" 
+      db="OVN_Northbound"/> column of <ref table="NB_Global"
        db="OVN_Northbound"/> table.
      </p>
  @@ -820,12 +826,15 @@
      <ul>
        <li>
          A priority 34000 logical flow is added for each logical switch datapath -        with the match <code>eth.dst = <var>E</var></code> to allow the service 
-        monitor reply packet destined to <code>ovn-controller</code>
-        that sets the allow bit, where <var>E</var> is the
-        service monitor mac defined in the
+        with the match <code>eth.dst = <var>E</var> || ip4.dst == <var>I</var> 
+        </code> to allow the service monitor reply packet destined to
+        <code>ovn-controller</code> that sets the allow bit, where <var>E</var> 
+        is the service monitor mac defined in the
          <ref column="options:svc_monitor_mac" table="NB_Global"
          db="OVN_Northbound"/> column of <ref table="NB_Global"
+        db="OVN_Northbound"/> table and <var>I</var> is the service monitor IP +        defined in the <ref column="options:svc_monitor_ip4" table="NB_Global" 
+        db="OVN_Northbound"/> column of <ref table="NB_Global"
          db="OVN_Northbound"/> table.
        </li>
      </ul>
@@ -1883,11 +1892,16 @@ output;
      <ul>
        <li>
          A priority-110 flow with the match
-        <code>eth.src == <var>E</var></code> for all logical switch
-        datapaths and applies the action <code>handle_svc_check(inport)</code>. 
-        Where <var>E</var> is the service monitor mac defined in the
+        <code>eth.src == <var>E</var> || ip4.dst == <var>I</var></code> for 
+        all logical switch datapaths and applies the action
+        <code>handle_svc_check(inport)</code>. Where <var>E</var> is the 
+        service monitor mac defined in the
          <ref column="options:svc_monitor_mac" table="NB_Global"
          db="OVN_Northbound"/> column of <ref table="NB_Global"
+        db="OVN_Northbound"/> table and <var>I</var> is the
+        service monitor IP defined in the
+        <ref column="options:svc_monitor_ip4" table="NB_Global"
+        db="OVN_Northbound"/> column of <ref table="NB_Global"
          db="OVN_Northbound"/> table.
        </li>
  diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
index 34bd25de7..dcb2e514c 100644
--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
@@ -2611,7 +2611,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e     table=8 (ls_in_acl_eval     ), priority=1    , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)     table=8 (ls_in_acl_eval     ), priority=1001 , match=(reg0[[7]] == 1 && (ip)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)     table=8 (ls_in_acl_eval     ), priority=1001 , match=(reg0[[8]] == 1 && (ip)), action=(reg8[[16]] = 1; next;) -  table=8 (ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=8 (ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=8 (ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=8 (ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=8 (ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) 
@@ -4318,7 +4318,7 @@ check_stateful_flows() {
      AT_CHECK([grep "ls_in_pre_lb" sw0flows | sort | sed 's/table=./table=?/'], [0], [dnl     table=? (ls_in_pre_lb       ), priority=0    , match=(1), action=(next;)     table=? (ls_in_pre_lb       ), priority=100  , match=(ip), action=(reg0[[2]] = 1; next;) -  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(eth.mcast), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(ip && inport == "sw0-lr0"), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;) 
@@ -4388,7 +4388,7 @@ AT_CAPTURE_FILE([sw0flows])
    AT_CHECK([grep "ls_in_pre_lb" sw0flows | sort | sed 's/table=./table=?/'], [0], [dnl     table=? (ls_in_pre_lb       ), priority=0    , match=(1), action=(next;) -  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(eth.mcast), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(ip && inport == "sw0-lr0"), action=(next;)     table=? (ls_in_pre_lb       ), priority=110  , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;) 
@@ -5079,7 +5079,7 @@ check ovn-nbctl --wait=sb sync
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5091,7 +5091,7 @@ AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], 
  ovn-sbctl lflow-list ls2 > ls2_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:01), action=(outport = "ls2-ro2"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:02), action=(outport = "vm2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5111,7 +5111,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat 20.0.0.200 192.168.2.200/30 
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5125,7 +5125,7 @@ AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], 
  ovn-sbctl lflow-list ls2 > ls2_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:01), action=(outport = "ls2-ro2"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:02), action=(outport = "vm2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5147,7 +5147,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat 40.0.0.200 192.168.2.148/30 
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5163,7 +5163,7 @@ AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], 
  ovn-sbctl lflow-list ls2 > ls2_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:01), action=(outport = "ls2-ro2"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:02:02), action=(outport = "vm2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 
@@ -5184,7 +5184,7 @@ ovn-nbctl --wait=sb lr-lb-add ro1 lb1
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5204,7 +5204,7 @@ ovn-nbctl --wait=sb lb-add lb1 192.168.4.100:80 10.0.0.10:80 
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -5230,7 +5230,7 @@ ovn-nbctl --wait=sb lrp-set-gateway-chassis ro1-ls1 chassis-1 30 
  ovn-sbctl lflow-list ls1 > ls1_lflows
  AT_CHECK([grep "ls_in_l2_lkup" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:01), action=(outport = "ls1-ro1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:01:02), action=(outport = "vm1"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) @@ -7172,7 +7172,7 @@ AT_CHECK([grep -e "ls_in_acl.*eval" -e "ls_in_acl_hint" lsflows | sed 's/table=.     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[8]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=2004 , match=(reg0[[10]] == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; ct_commit { ct_mark.blocked = 1; }; next;)     table=??(ls_in_acl_eval     ), priority=2004 , match=(reg0[[9]] == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -7227,7 +7227,7 @@ AT_CHECK([grep -e "ls_in_acl.*eval" -e "ls_in_acl_hint" lsflows | sed 's/table=.     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && !ct.est), action=(reg0[[1]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -7282,7 +7282,7 @@ AT_CHECK([grep -e "ls_in_acl.*eval" -e "ls_in_acl_hint" lsflows | sed 's/table=.     table=??(ls_in_acl_eval     ), priority=2002 , match=(reg0[[8]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[7]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[8]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -7573,7 +7573,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_acl_hint     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(next;)     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_out_acl_eval    ), priority=65535, match=(1), action=(next;) @@ -7598,7 +7598,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_acl_hint     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(next;)     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_out_acl_eval    ), priority=65535, match=(1), action=(next;) @@ -7623,7 +7623,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_acl_hint     ), priority=65535, match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(next;)     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_out_acl_eval    ), priority=65535, match=(1), action=(next;) @@ -7656,11 +7656,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7693,11 +7693,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7730,11 +7730,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7771,7 +7771,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=1001 , match=(reg0[[7]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=1001 , match=(reg0[[8]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -7786,7 +7786,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), action=(reg0[[0]] = 1; next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7840,11 +7840,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7877,11 +7877,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7914,11 +7914,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -7955,7 +7955,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && !ct.est), action=(next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -7970,7 +7970,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), action=(reg0[[0]] = 1; next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -8023,11 +8023,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -8060,11 +8060,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -8097,11 +8097,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_hint     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) @@ -8137,7 +8137,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_eval     ), priority=0    , match=(1), action=(next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && !ct.est), action=(next;)     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;) -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;) +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;) @@ -8152,7 +8152,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E "ls_.*_acl" | sed 's/table=../table=??/     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)     table=??(ls_in_pre_acl      ), priority=0    , match=(1), action=(next;)     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), action=(reg0[[0]] = 1; next;) -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac), action=(next;) +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), action=(next;)     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)     table=??(ls_out_acl_action  ), priority=0    , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */) 
@@ -8324,7 +8324,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=0    , match=(1), action=(output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;)     table=??(ls_in_l2_unknown   ), priority=0    , match=(1), action=(output;)     table=??(ls_in_l2_unknown   ), priority=50   , match=(outport == "none"), action=(drop;) 
@@ -8349,7 +8349,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=0    , match=(1), action=(output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0p1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0p2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 
@@ -8375,7 +8375,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=0    , match=(1), action=(output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0p1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0p2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 
@@ -8402,7 +8402,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=0    , match=(1), action=(output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:01), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0p2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 
@@ -8430,7 +8430,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=110  , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:01), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0p2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 
@@ -8462,7 +8462,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl
    table=??(ls_out_apply_port_sec), priority=110  , match=(outport == "localnetport" && inport == "sw0p2"), action=(set_queue(10); output;)     table=??(ls_out_apply_port_sec), priority=50   , match=(reg0[[15]] == 1), action=(drop;)     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), action=(outport = get_fdb(eth.dst); next;) -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);) +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0p1"; output;)     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0p2"; output;)     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), action=(outport = "_MC_flood"; output;) 


_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to