Tshark - Two types of OpenFlow FLOW_MOD packets

0
votes

I am running an SDN controller on port #6633 and then capturing the packets going to it using tshark which is give me following output:

*18 0.029550379 127.0.0.1 ?~F~R 127.0.0.1 OpenFlow 138 Type: OFPT_FLOW_MOD* 19 0.031562043 127.0.0.1 ?~F~R 127.0.0.1 TCP 88 8984?~F~R56292 [PSH, ACK] Seq=1 Ack=86 Win=86 Len=22 TSval=7474079 TSecr=7474075 20 0.031591119 127.0.0.1 ?~F~R 127.0.0.1 TCP 66 56292?~F~R8984 [ACK] Seq=86 Ack=23 Win=86 Len=0 TSval=7474079 TSecr=7474079 21 0.031786109 127.0.0.1 ?~F~R 127.0.0.1 TCP 163 56292?~F~R8984 [PSH, ACK] Seq=86 Ack=23 Win=86 Len=97 TSval=7474079 TSecr=7474079 *22 0.031958834 127.0.0.1 ?~F~R 127.0.0.1 OpenFlow 146 Type: OFPT_FLOW_MOD* 23 0.032035439 127.0.0.1 ?~F~R 127.0.0.1 TCP 66 47418?~F~R6633 [ACK] Seq=341 Ack=169 Win=44032 Len=0 TSval=7474079 TSecr=7474079 24 0.032732179 127.0.0.1 ?~F~R 127.0.0.1 TCP 88 8984?~F~R56292 [PSH, ACK] Seq=23 Ack=183 Win=86 Len=22 TSval=7474080 TSecr=7474079 25 0.038687398 36:68:ff:8e:d1:9c ?~F~R Broadcast OpenFlow 126 Type: OFPT_PACKET_IN

As per my application, there should be only one flow rule installed in switch. When I used the dpctl dump-flows in mininet then it also returned me only one flow rule. Now I have doubt because there are two flow mod packets.

In Packet #18 and 22 both are OFPT_FLOW_MOD packets, but if you see then both packets have a different number after OpenFlow keyword, see the third column. Could anyone explain it to me?

1
tcpdumpsdnmininettsharkopenflow

1 Answers

0
votes

There's a number after every protocol, not just OpenFlow packets. Take a look at the others, for example packet #19 "TCP 88".

In all likelihood, you have a Wireshark Length column following the Protocol column, and this value is just the number of bytes in the packet. Check your Wireshark columns; tshark just uses the same ones by default.