OVS-TCPDUMP(8)

📦
version 3.6.2 · 18 versions
, in fedora 43

💅 OVS-TCPDUMP — the ovs-tcpdump page, bestie edition 💅

okay so you're reading the Open vSwitch manual page for ovs-tcpdump (that's the OVS-TCPDUMP(8) section of the manual, iykyk) and honestly? it's a good one. let's get into it ✨

🦋 NAME 🦋

ovs-tcpdump — dump traffic from an Open vSwitch port using tcpdump. that's the whole vibe. you point it at a port, it snitches on the packets. no cap 💅

🌸 SYNOPSIS 🌸

ovs-tcpdump -i <port> <tcpdump options>...

💖 DESCRIPTION 💖

so here's the tea: ovs-tcpdump creates switch mirror ports in the ovs-vswitchd daemon and then executes tcpdump to listen against those ports. when the tcpdump instance exits, it cleans up the mirror port it created. responsible queen behavior, honestly 👑

ovs-tcpdump will not allow multiple mirrors for the same port. it has some logic to parse the current configuration and prevent duplicate mirrors. it's giving bodyguard energy 🫶

The -i option may not appear multiple times. one port, one mirror. periodt.

⚠️ important bestie moment: under Linux-based kernels, tap devices do not receive packets unless the specific tuntap device has been opened by an application. this requires CAP_NET_ADMIN privileges, so the ovs-tcpdump command must be run as a user with such permissions (this is usually a super-user). so like… sudo, basically. don't come for me, it's just the rules 😭

✨ OPTIONS ✨

  • -h, --help — prints a brief help message to the console. little helpful angel 🎀
  • -V, --version — prints version information to the console. who are you? what version are you? main character questions 💅
  • --db-sock <socket> — the Open vSwitch database socket connection string. the default is unix:<rundir>/db.sock. that's the default, don't forget it 🍓
  • --dump-cmd <command> — the command to run instead of tcpdump. yes, you can swap out the star of the show, iconic behavior honestly 🌟
  • -i, --interface — the interface for which a mirror port should be created, and packets should be dumped. this is the port you're obsessed with 💜
  • --mirror-to — the name of the interface which should be the destination of the mirrored packets. if the specified interface does not exist, it will be created as part of the setup process. if the interface already exists, it must be a port type that can be used with the tcpdump utility. mirror ports cannot be used for normal traffic. the default value is mi<port>. lowkey a whole little lifecycle going on here 🦋
  • --span — if specified, mirror all ports (optional). all of them. every single one. go big or go home 🔥
  • --filter <flow> — if specified, only mirror packets that match the provided OpenFlow filter. the available fields are documented in ovs-fields(7). selective attention, we love to see it ⭐

🌈 SEE ALSO 🌈

ovs-appctl(8), ovs-vswitchd(8), ovs-pcap(1), ovs-fields(7), ovs-tcpundump(1), tcpdump(8), wireshark(8). the whole friend group fr fr 🫶

👑 AUTHOR 👑

The Open vSwitch Development Community. legends only.

2016-2024, The Open vSwitch Development Community

💌 and that's the page!! this one's from Open vSwitch version 3.6, dated Feb 13, 2026 — go dump some packets, bestie, you're gonna slay 💅✨🌸
📦 where this page comes from