controller(8)

NAME
controller - simple OpenFlow controller reference implementation

SYNOPSIS
controller [options] method [method]...

DESCRIPTION
A sample OpenFlow controller which functions as an L2 MAC-learning switch or hub. controller can manage a remote datapath through a secure channel (see ofprotocol(8)). It can also connect directly to a local datapath via Netlink.

controller controls one or more OpenFlow switches, specified as one or more of the following OpenFlow connection methods:

pssl:[port]
    Listens for SSL connections from remote OpenFlow switches on port (default: 6633). The --private-key, --certificate, and --ca-cert options are mandatory when this form is used.

ptcp:[port]
    Listens for TCP connections from remote OpenFlow switches on port (default: 6633).

punix:file
    Listens for connections from OpenFlow switches on the Unix domain server socket named file.

nl:dp_idx
    The local Netlink datapath numbered dp_idx, as configured with dpctl(8). This form requires that the local host has the OpenFlow kernel module for Linux loaded.

ssl:host[:port]
    The specified SSL port (default: 6633) on the given remote host. The --private-key, --certificate, and --ca-cert options are mandatory when this form is used.

tcp:host[:port]
    The specified TCP port (default: 6633) on the given remote host.

unix:file
    The Unix domain server socket named file.

OPTIONS

-p, --private-key=privkey.pem
    Specifies a PEM file containing the private key used as the switch's identity for SSL connections to the controller.

-c, --certificate=cert.pem
    Specifies a PEM file containing a certificate, signed by the controller's certificate authority (CA), that certifies the switch's private key to identify a trustworthy switch.

-C, --ca-cert=switch-cacert.pem
    Specifies a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller.

--peer-ca-cert=controller-cacert.pem
    Specifies a PEM file that contains one or more additional certificates to send to switches. controller-cacert.pem should be the CA certificate used to sign the controller's own certificate (the certificate specified on -c or --certificate).

    This option is not useful in normal operation, because the switch must already have the controller CA certificate for it to have any confidence in the controller's identity. However, this option allows a newly installed switch to obtain the controller CA certificate on first boot using, e.g., the --bootstrap-ca-cert option to ofprotocol(8).

-n, --noflow
    By default, the controller sets up a flow in each OpenFlow switch whenever it receives a packet whose destination is known due through MAC learning. This option disables flow setup, so that every packet in the network passes through the controller.

    This option is most useful for debugging. It reduces switching performance, so it should not be used in production.

--max-idle=secs|permanent
    Sets secs as the number of seconds that a flow set up by the controller will remain in the switch's flow table without any matching packets being seen. If permanent is specified, which is not recommended, flows will never expire. The default is 60 seconds.

    This option affects only flows set up by the OpenFlow controller. In some configurations, the OpenFlow secure channel can set up some flows on its own. To set the idle time for those flows, pass --max-idle to ofprotocol(8).

    This option has no effect when -n (or --noflow) is in use (because the controller does not set up flows in that case).

-H, --hub
    By default, the controller acts as an L2 MAC-learning switch. This option changes its behavior to that of a hub that floods packets on all but the incoming port.

    If -H (or --hub) and -n (or --noflow) are used together, then the cumulative effect is that every packet passes through the controller and every packet is flooded.

    This option is most useful for debugging. It reduces switching performance, so it should not be used in production.

-P[pidfile], --pidfile[=pidfile]
    Causes a file (by default, controller.pid) to be created indicating the PID of the running process. If pidfile is not specified, or if it does not begin with /, then it is created in /var/run.

-f, --force
    By default, when -P or --pidfile is specified and the specified pidfile already exists and is locked by a running process, controller refuses to start. Specify -f or --force to cause it to instead overwrite the pidfile.

    When -P or --pidfile is not specified, this option has no effect.

-D, --detach
    Causes controller to detach itself from the foreground session and run as a background process.

-vmodule[:facility[:level]], --verbose=module[:facility[:level]]

    Sets the logging level for module in facility to level:

    •   module may be any valid module name (as displayed by the --list action on vlogconf(8)), or the special name ANY to set the logging levels for all modules.

    •   facility may be syslog, console, or file to set the levels for logging to the system log, the console, or a file respectively, or ANY to set the logging levels for both facilities. If it is omitted, facility defaults to ANY.

        Regardless of the log levels set for file, logging to a file will not take place unless --log-file is also specified (see below).

    •   level must be one of emer, err, warn, info, or dbg, designating the minimum severity of a message for it to be logged. If it is omitted, level defaults to dbg.

-v, --verbose
    Sets the maximum logging verbosity level, equivalent to --verbose=ANY:ANY:dbg.

-vPATTERN:facility:pattern, --verbose=PATTERN:facility:pattern
    Sets the log pattern for facility to pattern. Refer to vlogconf(8) for a description of the valid syntax for pattern.

--log-file[=file]
    Enables logging to a file. If file is specified, then it is used as the exact name for the log file. The default log file name used if file is omitted is /var/log/openflow/controller.log.

-h, --help
    Prints a brief help message to the console.

-V, --version
    Prints version information to the console.

EXAMPLES

To connect directly to local datapath 0 over netlink (Linux only):

    % controller nl:0

To bind locally to port 6633 (the default) and wait for incoming connections from OpenFlow switches:

    % controller ptcp:

SEE ALSO

dpctl(8), ofprotocol(8), ofdatapath(8), vlogconf(8)