Open vSwitch: Beyond Linux Bridge

In previous chapters, we learned how Linux networking primitives can be combined to build powerful virtual networks.

We used:

Network namespaces
veth pairs
Linux bridges
GRE tunnels
VXLAN tunnels

Using these tools, Linux can emulate much of the functionality of physical networking equipment.

However, as environments become larger and more dynamic, the traditional Linux bridge begins to show limitations.

Modern virtualization platforms, cloud environments, and SDN systems often require:

Advanced switching features
Programmable forwarding
Fine-grained traffic control
Integration with software-defined networking (SDN)
Large-scale VXLAN deployments

This is where Open vSwitch enters the picture.

Open vSwitch (OVS) is one of the most important technologies in modern virtual networking and forms the foundation of platforms such as OpenStack, VMware NSX, and many SDN solutions.

In this chapter, you will learn:

What Open vSwitch is
Why it exists
How it differs from Linux Bridge
The architecture of Open vSwitch
Basic OVS management commands
How to build virtual networks with OVS
Why OVS became popular in cloud environments

What Is Open vSwitch?

Open vSwitch is a software switch designed for virtualized environments.

It performs many of the same functions as a Linux bridge:

Layer 2 forwarding
MAC learning
Frame switching
VLAN support

But it also adds:

OpenFlow support
Programmable forwarding rules
Advanced tunneling
Traffic engineering
SDN integration
Monitoring and visibility features

You can think of OVS as:

Linux Bridge++

or more accurately:

A software switch designed for data centers.

Linux Bridge vs Open vSwitch

At first glance, both technologies appear similar.

Both can connect interfaces together.

Example:

veth1
   \
    \
     Switch
    /
   /
veth2

The difference becomes apparent as requirements grow.

Feature	Linux Bridge	Open vSwitch
Layer 2 Switching	Yes	Yes
MAC Learning	Yes	Yes
VLAN Support	Yes	Yes
STP Support	Yes	Yes
OpenFlow	No	Yes
VXLAN Integration	Basic	Advanced
SDN Integration	No	Yes
Programmable Pipelines	No	Yes
Cloud Usage	Moderate	Extensive

Linux Bridge is simple.

OVS is designed for large-scale virtual networking.

Why Open vSwitch Was Created

Consider a virtualization host:

VM1
VM2
VM3
VM4

connected through a Linux bridge:

VM1
  |
VM2
  |
 br0
  |
VM3
  |
VM4

This works well.

Now imagine:

Thousands of VMs
Hundreds of hypervisors
VXLAN overlays
Dynamic network provisioning
Tenant isolation
Centralized policy enforcement

Managing such an environment using only traditional Linux networking becomes increasingly difficult.

OVS was created specifically to solve these problems.

Open vSwitch Architecture

Open vSwitch consists of several components.

+-------------------+
| ovs-vsctl         |
+-------------------+

         |

+-------------------+
| ovsdb-server      |
+-------------------+

         |

+-------------------+
| ovs-vswitchd      |
+-------------------+

         |

+-------------------+
| Linux Kernel      |
+-------------------+

The major components are:

Component	Purpose
ovs-vsctl	Configuration tool
ovsdb-server	Configuration database
ovs-vswitchd	Switch daemon
Kernel Datapath	Packet forwarding

Installing Open vSwitch

On Debian or Ubuntu:

sudo apt install openvswitch-switch

Verify installation:

ovs-vsctl show

Example:

UUID

An empty configuration is expected initially.

Check services:

systemctl status openvswitch-switch

Understanding Bridges in OVS

In OVS, a bridge is still the central switching component.

Create a bridge:

sudo ovs-vsctl add-br br0

Verify:

ovs-vsctl show

Example:

Bridge br0

You can think of an OVS bridge as a virtual switch.

Viewing OVS Interfaces

List interfaces:

sudo ovs-vsctl list interface

List ports:

sudo ovs-vsctl list port

List bridges:

sudo ovs-vsctl list bridge

These commands provide significantly more visibility than traditional bridge management tools.

Adding Ports

Create a veth pair:

sudo ip link add veth1 type veth peer name veth2

Bring them up:

sudo ip link set veth1 up
sudo ip link set veth2 up

Attach one side:

sudo ovs-vsctl add-port br0 veth1

Verify:

ovs-vsctl show

Example:

Bridge br0
    Port veth1

Building a Simple OVS Switch

Create two veth pairs:

sudo ip link add veth1 type veth peer name veth2
sudo ip link add veth3 type veth peer name veth4

Bring interfaces up:

sudo ip link set veth1 up
sudo ip link set veth2 up
sudo ip link set veth3 up
sudo ip link set veth4 up

Create bridge:

sudo ovs-vsctl add-br br0

Add ports:

sudo ovs-vsctl add-port br0 veth1
sudo ovs-vsctl add-port br0 veth3

Topology:

veth2
   |
 veth1
   |
 +-----+
 | br0 |
 +-----+
   |
 veth3
   |
veth4

OVS now switches traffic between the connected ports.

Inspecting the Datapath

View datapath information:

sudo ovs-dpctl show

Example:

system@ovs-system:

View datapath flows:

sudo ovs-dpctl dump-flows

This reveals forwarding behavior inside the kernel datapath.

Understanding OpenFlow

One of the defining features of OVS is OpenFlow.

Traditional switches make forwarding decisions internally:

Frame arrives
      |
MAC lookup
      |
Forward

OpenFlow introduces programmable forwarding:

Packet arrives
      |
Flow Table Lookup
      |
Apply Actions
      |
Forward

This allows external controllers to determine how traffic should be handled.

Viewing OpenFlow Rules

Show flow table:

sudo ovs-ofctl dump-flows br0

Example:

cookie=0x0

Initially, only a few default flows may exist.

As traffic passes through OVS, additional flow entries may appear.

Adding a Simple Flow

Allow packets entering one port to exit another.

Determine port numbers:

ovs-ofctl show br0

Example:

1(veth1)
2(veth3)

Add flow:

sudo ovs-ofctl add-flow br0 \
"in_port=1,actions=output:2"

Add reverse flow:

sudo ovs-ofctl add-flow br0 \
"in_port=2,actions=output:1"

Display flows:

sudo ovs-ofctl dump-flows br0

You have now manually programmed switch forwarding behavior.

OVS and VXLAN

One reason OVS became extremely popular is its VXLAN support.

Create a VXLAN port:

sudo ovs-vsctl add-port br0 vxlan0 \
-- set interface vxlan0 type=vxlan \
options:remote_ip=192.168.100.2 \
options:key=100

Verify:

ovs-vsctl show

OVS now treats the VXLAN tunnel as a normal switch port.

This capability forms the basis of many cloud networking platforms.

OVS and SDN Controllers

A major advantage of OVS is integration with SDN controllers.

Example architecture:

+----------------------+
| SDN Controller       |
+----------------------+
           |
           |
      OpenFlow
           |
           |
+----------------------+
| Open vSwitch         |
+----------------------+

The controller can:

Install flows
Remove flows
Create tunnels
Enforce policies
Monitor traffic

This allows networking decisions to be centralized.

Packet Processing in OVS

When a packet arrives:

Packet
  |
Kernel Datapath
  |
Flow Lookup
  |
Action
  |
Forward

If no matching flow exists:

Packet
  |
Userspace
  |
Flow Generated
  |
Cached
  |
Forwarded

Subsequent packets are processed in the kernel, improving performance.

OVS in Real Environments

OVS is widely used by:

OpenStack Neutron
VMware NSX
OVN (Open Virtual Network)
Network virtualization platforms
SDN laboratories
Telecom and NFV environments

Although many administrators never interact with OVS directly, it is often responsible for forwarding traffic underneath the platform.

Linux Bridge or Open vSwitch?

For many Linux hosts:

Linux Bridge

is perfectly sufficient.

Examples:

Small virtualization environments
Home labs
Basic container networking
Learning Linux networking

OVS becomes valuable when:

VXLAN overlays are required
SDN integration is needed
Advanced switching policies are required
Large-scale virtual networking is involved

Choose the simplest solution that satisfies your requirements.

Looking Ahead

At this point, we have explored:

Linux bridges
GRE tunnels
VXLAN overlays
Open vSwitch

The next chapter focuses on advanced routing techniques such as policy routing and VRFs, which allow Linux to make forwarding decisions based on much more than a simple destination address lookup.

These techniques are heavily used in service provider, cloud, and multi-tenant environments.

Key Takeaways

Open vSwitch is a software switch designed for virtualized and cloud environments.
OVS provides Layer 2 switching similar to Linux Bridge.
OVS adds programmable forwarding through OpenFlow.
OVS integrates naturally with VXLAN and SDN platforms.
OVS consists of a userspace control plane and a kernel datapath.
Flow tables determine how packets are processed and forwarded.
OVS is widely used in OpenStack, VMware NSX, OVN, and many SDN systems.
Linux Bridge is simpler, while OVS is designed for advanced virtual networking environments.

Networking for Non-Network Engineers