Is there a delay for openflow rules added with ovs-vsctl tool?

I am successfully limiting the traffic of a specific interface with:

ovs-vsctl set interface s0-eth1 ingress_policing_rate=128

However, it takes some 5 seconds until I see any effect. I monitor host h1 (connected to s0-eth1) with ifstat while performing a SYN flood attack from other hosts.

I am using mininet version 2.2.1 with Open vSwitch version 2.5.0 and OpenFlow 1.4.


Ingress policing on OVS is not implemented using OpenFlow, but is implemented as a Token Bucket, according to the OVS manual.

  • The size of the bucket corresponds to ingress_policing_burst. Initially the bucket is full.

  • Whenever a packet is received, its size (converted to tokens) is compared to the number of tokens currently in the bucket. If the required number of tokens are available, they are removed and the packet is forwarded. Otherwise, the packet is dropped.

  • Whenever it is not full, the bucket is refilled with tokens at the rate specified by ingress_policing_rate.

That said, considering the Token bucket starts full and its size equal to the limit you are imposing, then, depending on the network activity, it might take some time to have the bucket nearly empty and start dropping packets.

Your Answer

