)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-05-28 23:02:34 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This is a specification for introducing Tap-as-a-Service in"},{"line_number":8,"context_line":"openstack neutron."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification aims to add port mirroring capability for tenant"},{"line_number":11,"context_line":"networks in neutron. The specification covers the description of the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_6fabd989","line":8,"updated":"2014-05-29 23:06:08.000000000","message":"nit: Just say some thing like:\nIntroducing Tap-as-a-Service\n\nPer conventions the title should not be more than 50 characters.","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"fa84d2b8a9801e2a3d01202b9d01ab8807a99a95","unresolved":false,"context_lines":[{"line_number":12,"context_line":"service along with its intended usecase. The specification also includes"},{"line_number":13,"context_line":"the data model and REST API changes."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Addressing the review comments from Marios Andreou."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    Changes made:"},{"line_number":18,"context_line":"    1. Removed all trailing white spaces."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3ae8d1ca_18096195","line":15,"updated":"2014-05-29 09:01:38.000000000","message":"thanks Vinay, the sentiment is appreciated but I don\u0027t think you need to go to this trouble with gerrit (I guess you may be new to the tool). The change history is available any time. You can select a version of the review and get a diff from any other version. You will quickly become exhausted doing this for every review!","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":12,"context_line":"service along with its intended usecase. The specification also includes"},{"line_number":13,"context_line":"the data model and REST API changes."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Addressing the review comments from Marios Andreou."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    Changes made:"},{"line_number":18,"context_line":"    1. Removed all trailing white spaces."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_ef9e0963","line":15,"in_reply_to":"3ae8d1ca_18096195","updated":"2014-05-29 23:06:08.000000000","message":"Yes, the change history should not need to be documented in the commit message, you may put that as a comment after you push a new patch.","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":23,"context_line":"       traffic from all the ports of a tenant virtual network in the"},{"line_number":24,"context_line":"       description section."},{"line_number":25,"context_line":"    5. Other small editorial changes."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: I087d9d2a802ea39c02259f17d2b8c4e2f6d8d714"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_0faa5570","line":26,"updated":"2014-05-29 23:06:08.000000000","message":"You might also want to link this to the launchpad URL:\n\n  Implements: blueprint port-mirroring","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"f2a0aade1e0c5c396380818d2859af589c35651a","unresolved":false,"context_lines":[{"line_number":11,"context_line":"service along with its intended usecase. The specification also includes"},{"line_number":12,"context_line":"the data model and REST API changes."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Implements: https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: I087d9d2a802ea39c02259f17d2b8c4e2f6d8d714"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"1ae5cdf2_1eecbc8e","line":14,"updated":"2014-06-03 20:21:36.000000000","message":"Nit: as Sumit commented in patchset 2 and as per convention, just use \"Implements: blueprint port-mirroring\". It will automatically be linked and added to the whiteboard.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"c59f82cf4ea85474db66e64854051bf3ade3594d","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     vnyyad \u003cvinay.yadhav@ericsson.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-06-25 15:27:55 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Introducing Tap-as-a-Service"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This specification aims to add port mirroring capability for tenant"},{"line_number":10,"context_line":"networks in Neutron. The specification covers the description of the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"baada198_a6a88121","line":7,"updated":"2014-07-16 20:20:22.000000000","message":"Title and Implements mismatch: another example as to why calling this feature TaaS is a bad idea.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Introducing Tap-as-a-Service"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This specification aims to add port mirroring capability for tenant"},{"line_number":10,"context_line":"networks in Neutron. The specification covers the description of the"},{"line_number":11,"context_line":"service along with its intended usecase. The specification also includes"},{"line_number":12,"context_line":"the data model and REST API changes."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"3a961159_f6fbb078","line":9,"updated":"2014-12-19 00:06:18.000000000","message":"This spec should be moved to the kilo directory.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"}],"specs/juno/tap-as-a-service.rst":[{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"URL of the launchpad blueprint:"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in "},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or "},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the "},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_48189e81","line":14,"updated":"2014-05-28 13:17:52.000000000","message":"trailing whitespace nit (and all following lines)","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"URL of the launchpad blueprint:"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in "},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or "},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the "},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_3e5e28e7","line":14,"in_reply_to":"3ae8d1ca_48189e81","updated":"2014-05-28 15:16:06.000000000","message":"will get rid of the trailing white spaces.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in "},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or "},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the "},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress "},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_e337cbae","line":15,"updated":"2014-05-28 13:17:52.000000000","message":"In an ethernet switch (i.e. neutron subnet) each unicast ethernet frame is switched from ingress to egress port, which means there is no single switch port from which to monitor all traffic in/egressing that switch. All modern switches offer port mirroring (aka \u0027SPAN\u0027) as a means of overcoming this limitation (e.g. to send all traffic to an IDS system, for monitoring in high security scenarios  etc).  \n(just suggestion)","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in "},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or "},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the "},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress "},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_9ef2dc98","line":15,"in_reply_to":"3ae8d1ca_e337cbae","updated":"2014-05-28 15:16:06.000000000","message":"In the first version of the service the aim is to mirror only the traffic transiting a particular port.As you suggested in the latter version it would be helpful to mirror all traffic transiting a \u0027virtual switch\u0027 of a tenant.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring "},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would "},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce "},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_23b533ee","line":31,"updated":"2014-05-28 13:17:52.000000000","message":"There are many applications for this feature and would allow tenants finer control of traffic flow (e.g. for analysis and/or security).","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring "},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would "},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce "},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_1e5b2c88","line":31,"in_reply_to":"3ae8d1ca_23b533ee","updated":"2014-05-28 15:16:06.000000000","message":"The other uses of port mirroring are mentioned the next paragraph","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce nuetron "},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the "},{"line_number":72,"context_line":"neutron port that was created by instantiating the tap service to capture "},{"line_number":73,"context_line":"or analyze the mirrored traffic."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_a3db031a","line":71,"updated":"2014-05-28 13:17:52.000000000","message":"my immediate reaction was \u0027why launch a vm specifically\u0027... I guess right now, we only attach ports to VMs in neutron. Once something like external ports lands  Ieea08993f364415c56e3416b1d222101ce5d1ac9 you can attach the mirror port to whatever","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce nuetron "},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the "},{"line_number":72,"context_line":"neutron port that was created by instantiating the tap service to capture "},{"line_number":73,"context_line":"or analyze the mirrored traffic."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_7e7430cf","line":71,"in_reply_to":"3ae8d1ca_a3db031a","updated":"2014-05-28 15:16:06.000000000","message":"Agreed, this in fact is the idea, since as of now we do not have the concept of external ports, for the first version it is mentioned that the mirrored traffic will be consumed by a VM. I will make it more clear by adding text to reflect the suggestion.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"c174a0ecbcc9d691d53947998a61809b450dc069","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":".. code-block:: python"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"  direction_enum \u003d [None, \u0027IN\u0027, \u0027OUT\u0027, \u0027BI\u0027]"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  RESOURCE_ATTRIBUTE_MAP \u003d {"},{"line_number":156,"context_line":"      TapService: {"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_264e1070","line":153,"updated":"2014-05-28 20:54:17.000000000","message":"There\u0027s an inconsistency between the code and the table above. I think you should change \u0027BI\u0027 to \u0027BOTH\u0027 so that the values of direction_enum match the values listed in the table.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"88ac2af1772f36af6c46ae3406428e11161e45ef","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":".. code-block:: python"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"  direction_enum \u003d [None, \u0027IN\u0027, \u0027OUT\u0027, \u0027BI\u0027]"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"  RESOURCE_ATTRIBUTE_MAP \u003d {"},{"line_number":156,"context_line":"      TapService: {"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_a9a3d39c","line":153,"in_reply_to":"3ae8d1ca_264e1070","updated":"2014-05-28 21:14:55.000000000","message":"Thanks for pointing it out, will convert BI to BOTH, the changes will be reflected in patch 3","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":201,"context_line":"Performance Impact"},{"line_number":202,"context_line":"------------------"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"None"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Other deployer impact"},{"line_number":207,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_636d7b32","line":204,"updated":"2014-05-28 13:17:52.000000000","message":"really? how are you going to duplicate the traffic (especially when both in/egress). Consider the practical case of an IDS where you want everything from all vms mirrored there. You\u0027d have multiple port mirrors active.\n\nThis is not really possible to quantify right now, but I think it at least needs mention here.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"c174a0ecbcc9d691d53947998a61809b450dc069","unresolved":false,"context_lines":[{"line_number":201,"context_line":"Performance Impact"},{"line_number":202,"context_line":"------------------"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"None"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Other deployer impact"},{"line_number":207,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_06e3d433","line":204,"in_reply_to":"3ae8d1ca_1e132c67","updated":"2014-05-28 20:54:17.000000000","message":"Yep, there\u0027s definitely a risk of oversubscribing a physical interface when monitoring traffic. Very soon after getting a prototype working you\u0027re most likely going to want to address rate limiting options as well as selection criteria. I don\u0027t know what OvS is capable of, but you\u0027ll almost certainly want to be able to specify capture filters that are more granular than just \"everything through the port\". tcpdump\u0027s capture filter syntax would be a good place to start.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":201,"context_line":"Performance Impact"},{"line_number":202,"context_line":"------------------"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"None"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Other deployer impact"},{"line_number":207,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_1e132c67","line":204,"in_reply_to":"3ae8d1ca_636d7b32","updated":"2014-05-28 15:16:06.000000000","message":"Yes, i will mention it. Thanx for pointing it out.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"50cc11099455494f20267af2a903e971a5d5a81c","unresolved":false,"context_lines":[{"line_number":211,"context_line":"Developer impact"},{"line_number":212,"context_line":"----------------"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"This will be a new API, and will not affect existing API."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Implementation"},{"line_number":217,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_836a8718","line":214,"updated":"2014-05-28 13:17:52.000000000","message":"(extension API)","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"79b3ffdd444ec93e5c5587f01389e50a113d42a4","unresolved":false,"context_lines":[{"line_number":211,"context_line":"Developer impact"},{"line_number":212,"context_line":"----------------"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"This will be a new API, and will not affect existing API."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Implementation"},{"line_number":217,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_be03180e","line":214,"in_reply_to":"3ae8d1ca_836a8718","updated":"2014-05-28 15:16:06.000000000","message":"yes, will be changed to extension API.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"c174a0ecbcc9d691d53947998a61809b450dc069","unresolved":false,"context_lines":[{"line_number":248,"context_line":"Documentation Impact"},{"line_number":249,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Both, API and, Admin guide will be updated."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"References"},{"line_number":254,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_c66d6c9b","line":251,"updated":"2014-05-28 20:54:17.000000000","message":"Too many commas. \"Both API and Admin guide will be updated.\" is fine. No commas needed in this sentence.","commit_id":"afde3fa2bb9f30b6606caaa4d93c8ffd7e3b44e6"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filter."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in neutron as an"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_af3ec127","line":21,"updated":"2014-05-29 23:06:08.000000000","message":"should the above be outbound filter (in the last sentence)?","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"def24be605a4d80cd93a98eb2b76359073f9e9e9","unresolved":false,"context_lines":[{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filter."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in neutron as an"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_8d7a1186","line":21,"in_reply_to":"1ae5cdf2_af3ec127","updated":"2014-06-05 17:54:20.000000000","message":"Sorry i was mistaken, \u0027inbound\u0027 is correct in the last line. The filters we are talking about in the last line pertain to the port on which the monitoring VM (where the mirrored packets will be sent) is connected and we do not want the mirrored traffic to pass though the inbound filters of that port (mirror destination port).","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"d3a8a99c4a7b910e9507105691bdac3bcc55ce36","unresolved":false,"context_lines":[{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filter."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in neutron as an"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_39ff1fac","line":21,"in_reply_to":"1ae5cdf2_af3ec127","updated":"2014-06-01 11:24:44.000000000","message":"Yes, you are correct. will make the change","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filter."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in neutron as an"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_4f7e1de6","line":23,"updated":"2014-05-29 23:06:08.000000000","message":"neutron -\u003e Neutron\nas an -\u003e as a","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"d3a8a99c4a7b910e9507105691bdac3bcc55ce36","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filter."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in neutron as an"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_592dcb45","line":23,"in_reply_to":"1ae5cdf2_4f7e1de6","updated":"2014-06-01 11:24:44.000000000","message":"sure.","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"4a901bf409f687e088243ea6f20b07dc9846195e","unresolved":false,"context_lines":[{"line_number":80,"context_line":"point of view"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  1. Create an instance of the tap service (creation of the service return back"},{"line_number":83,"context_line":"     with a neutron port UUID)."},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM on the port returned by the tap"},{"line_number":85,"context_line":"     service while creating the service."},{"line_number":86,"context_line":"  3. Create a tap flow by associating a neutron port that needs to be mirrored with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_4f9a9d15","line":83,"updated":"2014-05-29 23:06:08.000000000","message":"which network will this port be on?","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"d3a8a99c4a7b910e9507105691bdac3bcc55ce36","unresolved":false,"context_lines":[{"line_number":80,"context_line":"point of view"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  1. Create an instance of the tap service (creation of the service return back"},{"line_number":83,"context_line":"     with a neutron port UUID)."},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM on the port returned by the tap"},{"line_number":85,"context_line":"     service while creating the service."},{"line_number":86,"context_line":"  3. Create a tap flow by associating a neutron port that needs to be mirrored with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1ae5cdf2_f91bf719","line":83,"in_reply_to":"1ae5cdf2_4f9a9d15","updated":"2014-06-01 11:24:44.000000000","message":"I missed adding the network as a parameter in the API call to create the service, will add it. The idea is that the tenant has to specify which network the TaaS port will belong to, though it is possible to mirror traffic from port of other networks belonging to the tenant to be mirrored into this port.","commit_id":"36e922c2a3d10f6d30bb376045b9e4f2d99cbf46"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"3274d2252c7c422b17fb3e7a72a795379d2dd8cf","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_558559ab","line":17,"range":{"start_line":17,"start_character":32,"end_line":17,"end_character":38},"updated":"2014-06-03 09:16:54.000000000","message":"destination?","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"e687682cd957f93a98b98db4c92944d5e9d9683e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_5f80f445","line":17,"in_reply_to":"1ae5cdf2_11283ce1","updated":"2014-06-04 02:51:17.000000000","message":"i thought you meant the destination of the packet.\nthanks for clarification.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4fe98727b19df09da26d9fb384688fdbeab3f462","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_11283ce1","line":17,"in_reply_to":"1ae5cdf2_558559ab","updated":"2014-06-03 13:02:20.000000000","message":"When i say source VM, i intend to mean its the port from which the data will be mirrored. both entering it and leaving it.\n\nI don\u0027t know if i answered your question, if not please elaborate your question.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"3274d2252c7c422b17fb3e7a72a795379d2dd8cf","unresolved":false,"context_lines":[{"line_number":65,"context_line":"owned by the tenant who is requesting for the service. The ports to be"},{"line_number":66,"context_line":"mirrored that are added to the service can belong to any network owned by the"},{"line_number":67,"context_line":"tenant. This allow the tenant to mirror traffic from port(s) belonging to"},{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce nuetron"},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_e8212ca0","line":68,"range":{"start_line":68,"start_character":59,"end_line":68,"end_character":66},"updated":"2014-06-03 09:16:54.000000000","message":"neutron","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4fe98727b19df09da26d9fb384688fdbeab3f462","unresolved":false,"context_lines":[{"line_number":65,"context_line":"owned by the tenant who is requesting for the service. The ports to be"},{"line_number":66,"context_line":"mirrored that are added to the service can belong to any network owned by the"},{"line_number":67,"context_line":"tenant. This allow the tenant to mirror traffic from port(s) belonging to"},{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce nuetron"},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_4e56a32b","line":68,"in_reply_to":"1ae5cdf2_e8212ca0","updated":"2014-06-03 13:02:20.000000000","message":"thanks for the correction","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"3274d2252c7c422b17fb3e7a72a795379d2dd8cf","unresolved":false,"context_lines":[{"line_number":83,"context_line":"     with a neutron port UUID (The TaaS port is create on the network specified"},{"line_number":84,"context_line":"     by the tenant while creating the tap service in the REST API)."},{"line_number":85,"context_line":"  2. Launch a monitoring or traffic analysis VM on the port returned by the tap"},{"line_number":86,"context_line":"     service while creating the service."},{"line_number":87,"context_line":"  3. Create a tap flow by associating a neutron port that needs to be mirrored with"},{"line_number":88,"context_line":"     an already created tap service instance."},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_48c6a04a","line":86,"updated":"2014-06-03 09:16:54.000000000","message":"are you in touch with service VM folks?","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4fe98727b19df09da26d9fb384688fdbeab3f462","unresolved":false,"context_lines":[{"line_number":83,"context_line":"     with a neutron port UUID (The TaaS port is create on the network specified"},{"line_number":84,"context_line":"     by the tenant while creating the tap service in the REST API)."},{"line_number":85,"context_line":"  2. Launch a monitoring or traffic analysis VM on the port returned by the tap"},{"line_number":86,"context_line":"     service while creating the service."},{"line_number":87,"context_line":"  3. Create a tap flow by associating a neutron port that needs to be mirrored with"},{"line_number":88,"context_line":"     an already created tap service instance."},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2e0b172b","line":86,"in_reply_to":"1ae5cdf2_48c6a04a","updated":"2014-06-03 13:02:20.000000000","message":"Yes i am, we will also bring this up during the next weekly call.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":129,"context_line":"| id          | UUID   | CR, all  | generated | N/A           | UUID of the             |"},{"line_number":130,"context_line":"|             |        |          |           |               | TapFlow instance.       |"},{"line_number":131,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":132,"context_line":"| tap_id      | UUID   | CR, all  | N/A       | Valid tap     | UUID of the tap         |"},{"line_number":133,"context_line":"|             |        |          |           | service UUID  | service instance.       |"},{"line_number":134,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":135,"context_line":"| source_port | UUID   | CR, all  | N/A       | UUID of a     | UUID of the neutron     |"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d407a216","line":132,"updated":"2014-06-03 13:15:12.000000000","message":"tap_id is confusing at first (i.e., is it a tap service id or a tap flow?). Please consider changing it to tap_service_id.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":158,"context_line":"  direction_enum \u003d [None, \u0027IN\u0027, \u0027OUT\u0027, \u0027BOTH\u0027]"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"  RESOURCE_ATTRIBUTE_MAP \u003d {"},{"line_number":161,"context_line":"      TapService: {"},{"line_number":162,"context_line":"          \u0027id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":163,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":164,"context_line":"                 \u0027primary_key\u0027: True},"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_71e0a096","line":161,"updated":"2014-06-03 13:15:12.000000000","message":"Change from CamelCase to snake_case please","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":163,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":164,"context_line":"                 \u0027primary_key\u0027: True},"},{"line_number":165,"context_line":"          \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":166,"context_line":"                        \u0027validate\u0027: {\u0027type:string\u0027: None},"},{"line_number":167,"context_line":"                        \u0027required_by_policy\u0027: True, \u0027is_visible\u0027: True},"},{"line_number":168,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":169,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_f423bea4","line":166,"updated":"2014-06-03 13:15:12.000000000","message":"type should be uuid","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"7e90755fb83151bf71d50e95c47322df3236e7e0","unresolved":false,"context_lines":[{"line_number":163,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":164,"context_line":"                 \u0027primary_key\u0027: True},"},{"line_number":165,"context_line":"          \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":166,"context_line":"                        \u0027validate\u0027: {\u0027type:string\u0027: None},"},{"line_number":167,"context_line":"                        \u0027required_by_policy\u0027: True, \u0027is_visible\u0027: True},"},{"line_number":168,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":169,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d40de2e9","line":166,"in_reply_to":"1ae5cdf2_f423bea4","updated":"2014-06-03 13:22:26.000000000","message":"ignore. it should be a string.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":172,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":173,"context_line":"                               \u0027is_visible\u0027: False}"},{"line_number":174,"context_line":"      },"},{"line_number":175,"context_line":"      TapFlow: {"},{"line_number":176,"context_line":"          \u0027id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":177,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":178,"context_line":"                 \u0027primary_key\u0027: True},"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d1e6d4af","line":175,"updated":"2014-06-03 13:15:12.000000000","message":"Change from CamelCase to snake_case please","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":176,"context_line":"          \u0027id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":177,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":178,"context_line":"                 \u0027primary_key\u0027: True},"},{"line_number":179,"context_line":"          \u0027tap_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":180,"context_line":"                        \u0027validate\u0027: {\u0027type:string\u0027: None},"},{"line_number":181,"context_line":"                        \u0027required_by_policy\u0027: True, \u0027is_visible\u0027: True},"},{"line_number":182,"context_line":"          \u0027source_port\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_14158a3f","line":179,"updated":"2014-06-03 13:15:12.000000000","message":"Same as my comment above, suggesting changing to tap_service_id.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"a811a758f20724d48466458e126b2d9d99537a0a","unresolved":false,"context_lines":[{"line_number":177,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":178,"context_line":"                 \u0027primary_key\u0027: True},"},{"line_number":179,"context_line":"          \u0027tap_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":180,"context_line":"                        \u0027validate\u0027: {\u0027type:string\u0027: None},"},{"line_number":181,"context_line":"                        \u0027required_by_policy\u0027: True, \u0027is_visible\u0027: True},"},{"line_number":182,"context_line":"          \u0027source_port\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":183,"context_line":"                        \u0027validate\u0027: {\u0027type:uuid\u0027: None},"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_b42db697","line":180,"updated":"2014-06-03 13:15:12.000000000","message":"type should be uuid","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11682,"name":"Ryan Moats","email":"rmoats@us.ibm.com","username":"regXboi"},"change_message_id":"b501cdedbad4823605abde21dcb7cc8c788f894e","unresolved":false,"context_lines":[{"line_number":192,"context_line":"---------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":195,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":196,"context_line":"usually is destined to a VM that is not the same as the VM attached on"},{"line_number":197,"context_line":"the port that belongs to TaaS (mirror destination port)."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2da0b99e","line":195,"updated":"2014-06-01 19:02:06.000000000","message":"What does this mean with respect to security groups being allowed or disallowed on the source port?","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11682,"name":"Ryan Moats","email":"rmoats@us.ibm.com","username":"regXboi"},"change_message_id":"5fc67687e53325315ef80f1ab6a256d6f72d9d03","unresolved":false,"context_lines":[{"line_number":192,"context_line":"---------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":195,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":196,"context_line":"usually is destined to a VM that is not the same as the VM attached on"},{"line_number":197,"context_line":"the port that belongs to TaaS (mirror destination port)."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_b11c0415","line":195,"in_reply_to":"1ae5cdf2_0bd2e95b","updated":"2014-06-02 19:21:22.000000000","message":"That makes sense, let\u0027s get that text into the security impact statement and then I\u0027m happy to +1....","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"5b266a2cc206dc6ff2f5162b47570ec1f650e9ce","unresolved":false,"context_lines":[{"line_number":192,"context_line":"---------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":195,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":196,"context_line":"usually is destined to a VM that is not the same as the VM attached on"},{"line_number":197,"context_line":"the port that belongs to TaaS (mirror destination port)."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0bd2e95b","line":195,"in_reply_to":"1ae5cdf2_2da0b99e","updated":"2014-06-02 18:35:06.000000000","message":"Here is  a brief explanation.\n\nWe want to monitor all traffic that is \u0027actually\u0027 entering or leaving one or more source VMs. Traffic entering a source VM has already gone through its inbound security group filters. On the other hand, traffic exiting a VM has not yet passed though its outbound security filters. The source mirror ports should therefore (ideally) be placed at a logical spot that will allow packets to be intercepted after the application of inbound filters but before the application of outbound filters.\n\nThings are a little different on the destination side of the port mirror session. The receiving VM should be allowed to see all of the mirrored traffic. As a result, we want to skip its (the destination side\u0027s) inbound security group filters. \n\nOf course, the receiving VM\u0027s outbound security group filters will be applicable for any traffic leaving that VM.","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"3274d2252c7c422b17fb3e7a72a795379d2dd8cf","unresolved":false,"context_lines":[{"line_number":233,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The reference implementation for this service will be based on the OVS driver."},{"line_number":236,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":237,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":238,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":239,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_68f27cd3","line":236,"range":{"start_line":236,"start_character":24,"end_line":236,"end_character":66},"updated":"2014-06-03 09:16:54.000000000","message":"can you provide OVS \"create mirror\" arguments?","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"f08cb0f24e2ea07da2901280184ff55d5707998a","unresolved":false,"context_lines":[{"line_number":233,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The reference implementation for this service will be based on the OVS driver."},{"line_number":236,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":237,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":238,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":239,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_78121c0a","line":236,"in_reply_to":"1ae5cdf2_3f408806","updated":"2014-06-04 10:32:03.000000000","message":"Yes we will use it on the ports on br-int which need to be mirrored","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4fe98727b19df09da26d9fb384688fdbeab3f462","unresolved":false,"context_lines":[{"line_number":233,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The reference implementation for this service will be based on the OVS driver."},{"line_number":236,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":237,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":238,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":239,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_f101106b","line":236,"in_reply_to":"1ae5cdf2_68f27cd3","updated":"2014-06-03 13:02:20.000000000","message":"Below is an example of how to set port mirror: port being mirrored is \u0027A\u0027 and mirrored traffic is sent to \u0027B\u0027 (This example is for mirroring with in the same OVS switch). More info is available in the OVS documentation.\n\novs-vsctl -- set Bridge br-test mirrors\u003d@m \\\n -- --id\u003d@A get Port A \\\n -- --id\u003d@B get Port B \\\n -- --id\u003d@m create Mirror name\u003dtestmirror select-dst-port\u003d@A select-src-port\u003d@A output-port\u003d@B\n\nThis is a one set of parameters to mirror traffic entering in and out of port A and sending the mirrored traffic to port B.\n\nThere are other variations of this as well.\n\nThis is one of the posts is ovs-discussion forum, and it has some more variants, and as always the documentation gives the entire picture of all combinations of parameters.\n\nhttp://openvswitch.org/pipermail/discuss/2012-December/008527.html","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"e687682cd957f93a98b98db4c92944d5e9d9683e","unresolved":false,"context_lines":[{"line_number":233,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The reference implementation for this service will be based on the OVS driver."},{"line_number":236,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":237,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":238,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":239,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_3f408806","line":236,"in_reply_to":"1ae5cdf2_f101106b","updated":"2014-06-04 02:51:17.000000000","message":"sorry for being unclear.  my question was how you plan to use the feature.\neg. do you use it on br-int?  do you use select-vlan\u003d? etc","commit_id":"df36dde9c036b93de6a7dda515b0a519e7a8768e"},{"author":{"_account_id":11682,"name":"Ryan Moats","email":"rmoats@us.ibm.com","username":"regXboi"},"change_message_id":"f40aaba55a2cd9ba96b80cfcd2b89ac1ba0d6537","unresolved":false,"context_lines":[{"line_number":66,"context_line":"mirrored that are added to the service can belong to any network owned by the"},{"line_number":67,"context_line":"tenant. This allow the tenant to mirror traffic from port(s) belonging to"},{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce neutron"},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the"},{"line_number":72,"context_line":"neutron port that was created by instantiating the tap service to capture"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_fccc216c","line":69,"updated":"2014-06-05 20:39:46.000000000","message":"Please clarify the interaction with shared networks.  As written, this implies that if a tenant makes a shared network available, that tenant could tap any other tenants ports that are owned by the shared network.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"43ce56cd7cb7c34e89793996debacae67c944042","unresolved":false,"context_lines":[{"line_number":66,"context_line":"mirrored that are added to the service can belong to any network owned by the"},{"line_number":67,"context_line":"tenant. This allow the tenant to mirror traffic from port(s) belonging to"},{"line_number":68,"context_line":"any networks that they own on to the same Tap-as-a-Serivce neutron"},{"line_number":69,"context_line":"port."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In the first version of this service, the tenants can launch a VM on the"},{"line_number":72,"context_line":"neutron port that was created by instantiating the tap service to capture"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_21364ab5","line":69,"in_reply_to":"1ae5cdf2_fccc216c","updated":"2014-06-06 14:35:19.000000000","message":"Tenants are only allowed to mirror traffic from port(s) that they own. Even on a shared network, a tenant will only be allowed to mirror the traffic from port(s) that they own on the shared network and not traffic from port that they do not own on the shared network. So in essence tenants can only mirror traffic from port(s) that they own, even on a shared network.\n\nAbove is the intend that we wanted to express, i will try to rephrase the last paragraph to make this point explicitly clear in the next patch.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":1935,"name":"Tomoe Sugihara","email":"tomoe.sugihara@gmail.com","username":"tomoe"},"change_message_id":"a534007ef018964d197ad8e5a621eb6d6145e787","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Data model impact"},{"line_number":99,"context_line":"-----------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Tap-as-a-Service introduces the following data models into neutron as database"},{"line_number":102,"context_line":"schemas."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_7f0e39e6","line":100,"updated":"2014-06-06 07:08:16.000000000","message":"I wonder if users may want to have \"name\" and/or \"description\" fields so they can mange these resources better than they do only with uuids.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"8a691ff998c137830b7eb9195f3b6e5c68e9cc67","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Data model impact"},{"line_number":99,"context_line":"-----------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Tap-as-a-Service introduces the following data models into neutron as database"},{"line_number":102,"context_line":"schemas."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_fec31d55","line":100,"in_reply_to":"1ae5cdf2_7f0e39e6","updated":"2014-06-06 14:17:25.000000000","message":"Good point, will add name and description in the data model. updates will be reflected in next patch.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":1935,"name":"Tomoe Sugihara","email":"tomoe.sugihara@gmail.com","username":"tomoe"},"change_message_id":"a534007ef018964d197ad8e5a621eb6d6145e787","unresolved":false,"context_lines":[{"line_number":139,"context_line":"| direction      | ENUM   | CRU, all | BOTH      |               | Whether to mirror the   |"},{"line_number":140,"context_line":"|                | (IN,   |          |           |               | traffic leaving or      |"},{"line_number":141,"context_line":"|                | OUT,   |          |           |               | arriving at the         |"},{"line_number":142,"context_line":"|                | BOTH)  |          |           |               | source port             |"},{"line_number":143,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_5f3dfd8d","line":142,"updated":"2014-06-06 07:08:16.000000000","message":"Is this from endpoint\u0027s (e.g. VM) perspective or virtual network\u0027s perspective?","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"8a691ff998c137830b7eb9195f3b6e5c68e9cc67","unresolved":false,"context_lines":[{"line_number":139,"context_line":"| direction      | ENUM   | CRU, all | BOTH      |               | Whether to mirror the   |"},{"line_number":140,"context_line":"|                | (IN,   |          |           |               | traffic leaving or      |"},{"line_number":141,"context_line":"|                | OUT,   |          |           |               | arriving at the         |"},{"line_number":142,"context_line":"|                | BOTH)  |          |           |               | source port             |"},{"line_number":143,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_5eafb17d","line":142,"in_reply_to":"1ae5cdf2_5f3dfd8d","updated":"2014-06-06 14:17:25.000000000","message":"From end points perspective.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11682,"name":"Ryan Moats","email":"rmoats@us.ibm.com","username":"regXboi"},"change_message_id":"f40aaba55a2cd9ba96b80cfcd2b89ac1ba0d6537","unresolved":false,"context_lines":[{"line_number":202,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":203,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":204,"context_line":"application of outbound filters."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"On the destination side of the port mirror session, the receiving VM should be"},{"line_number":207,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":208,"context_line":"should not pass through the inbound security group filters, however the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_7c15719a","line":205,"updated":"2014-06-05 20:39:46.000000000","message":"I think it would be useful to allow location of the TaaS source port to be specified.  Specifically, if I could attach a TaaS on the opposite side of the security group filters given above  (i.e. before the inbound and after the outbound) then the combination provides a way to troubleshoot whether the security groups are filtering the proper traffic.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"43ce56cd7cb7c34e89793996debacae67c944042","unresolved":false,"context_lines":[{"line_number":202,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":203,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":204,"context_line":"application of outbound filters."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"On the destination side of the port mirror session, the receiving VM should be"},{"line_number":207,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":208,"context_line":"should not pass through the inbound security group filters, however the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_a1e5fa0b","line":205,"in_reply_to":"1ae5cdf2_7c15719a","updated":"2014-06-06 14:35:19.000000000","message":"I agree with the potential use this has. We are checking how this can be achieved. For now in the first version, the intend is to mirror the traffic as see on the neutron port. The next level would be provide the functionality that you described, which is also documented.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":1935,"name":"Tomoe Sugihara","email":"tomoe.sugihara@gmail.com","username":"tomoe"},"change_message_id":"a534007ef018964d197ad8e5a621eb6d6145e787","unresolved":false,"context_lines":[{"line_number":207,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":208,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":209,"context_line":"outbound filters should apply as normal."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"Notifications impact"},{"line_number":212,"context_line":"--------------------"},{"line_number":213,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_44a45b4a","line":210,"updated":"2014-06-06 07:08:16.000000000","message":"Though it\u0027s not implemented by many plugins yet, there\u0027s also port-security extension: https://blueprints.launchpad.net/neutron/+spec/port-security-api-base-class\n\nwhich, i believe, allows users to set up anti mac/ip spoofing filter on a neutron port. This has to be disabled on the mirrored port.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"8a691ff998c137830b7eb9195f3b6e5c68e9cc67","unresolved":false,"context_lines":[{"line_number":207,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":208,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":209,"context_line":"outbound filters should apply as normal."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"Notifications impact"},{"line_number":212,"context_line":"--------------------"},{"line_number":213,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_ded90124","line":210,"in_reply_to":"1ae5cdf2_44a45b4a","updated":"2014-06-06 14:17:25.000000000","message":"I will document this point in the next patch of the spec in this section. Thanks for point to it.","commit_id":"3d3ccabdebf2781d46c00836e2acfebe0ef80a76"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_6a285597","line":16,"updated":"2014-06-13 09:33:06.000000000","message":"should we make this explicit (and eg error out if src and dst port are same); can\u0027t think of a use case but doesn\u0027t mean there isn\u0027t one ...","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1cffe1e5faaa043290111e5c4609af0f81d5ee46","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_93fcc774","line":16,"in_reply_to":"1ae5cdf2_232753cb","updated":"2014-06-16 08:57:03.000000000","message":"right exactly this, thanks!","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_232753cb","line":16,"in_reply_to":"1ae5cdf2_6a285597","updated":"2014-06-13 14:41:23.000000000","message":"Sure, i will add some text in the proposed changes section to make it clear that the neutron port created to host the Tap-as-a-Service (dst port) itself cannot be a source port to be mirrored.\n\nI hope i understood your comment correctly.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_3e15ae3f","line":31,"updated":"2014-06-13 09:33:06.000000000","message":"s/features/feature and \u0027of benefit to\u0027","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_c31dcf74","line":31,"in_reply_to":"1ae5cdf2_3e15ae3f","updated":"2014-06-13 14:41:23.000000000","message":"thanx..., will change","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_9e2de291","line":32,"updated":"2014-06-13 09:33:06.000000000","message":"\", but also for many other use-cases that require access to (and perhaps inspection of) packets not originally intended for them.\"\n\njust saying, there are many use cases. Having \u0027debug\u0027 as the first seems to be selling it short.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_e7b01645","line":32,"in_reply_to":"1ae5cdf2_81e58739","updated":"2014-06-13 14:41:23.000000000","message":"Sure...","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1ddc3f7de5a98c28f5f5c942eb880950407ddfdc","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_81e58739","line":32,"in_reply_to":"1ae5cdf2_9e2de291","updated":"2014-06-13 09:41:20.000000000","message":"\u0027not intended for them\u0027 is wrong, \u0027any and all packets flowing within their administrative domain (i.e., tenant network)\u0027","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Neutron currently does not support the functionality of port mirroring"},{"line_number":31,"context_line":"in tenant networks. This features could be benefit the tenant who would"},{"line_number":32,"context_line":"like to debug their virtual networks. This neutron spec proposes to introduce"},{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_e7149645","line":32,"in_reply_to":"1ae5cdf2_9e2de291","updated":"2014-06-13 14:41:23.000000000","message":"I agree, will rephrase it to highlight other use case like IDS (mentioned latter in the document)","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_fe6c26d2","line":36,"updated":"2014-06-13 09:33:06.000000000","message":"\u0027element\u0027 - be as neutron specific as possible - \u0027port\u0027?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":33,"context_line":"the feature of port mirroring by adding a new service called Tap-as-a-Service."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_e797368e","line":36,"in_reply_to":"1ae5cdf2_fe6c26d2","updated":"2014-06-13 14:41:23.000000000","message":"Good idea... will eliminate ambiguity. will change.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_de3cca95","line":37,"updated":"2014-06-13 09:33:06.000000000","message":"\u0027one VM\u0027 do you mean \u0027one Neutron port\u0027 ?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_87d59244","line":37,"in_reply_to":"1ae5cdf2_de3cca95","updated":"2014-06-13 14:41:23.000000000","message":"Yes... i guess it is good to change it from VM to neutron port. will change","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_3e74ce66","line":38,"updated":"2014-06-13 09:33:06.000000000","message":"from a port (i may be wrong but the introduction above at line 15 speaks of ports)","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":35,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_c7595afe","line":38,"in_reply_to":"1ae5cdf2_3e74ce66","updated":"2014-06-13 14:41:23.000000000","message":"Yes VM -\u003e neutron port. I guess i have messed up the consistency wrt the terms used, will revise it to reflect neutron ports instead of VMs.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"},{"line_number":42,"context_line":"analyzing network traffic ingressing and egressing a VM. (ex. IDS)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_fedb464c","line":39,"updated":"2014-06-13 09:33:06.000000000","message":"\u0027arbitrary interface\u0027 - i wonder if it is worth mentioning the external port spec Ieea08993f364415c56e3416b1d222101ce5d1ac9 \"Add spec for neutron-external-attachment-points\" - could use this to arbitrarily connect devices","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":36,"context_line":"packets traversing a network element. This neutron spec focuses on"},{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"},{"line_number":42,"context_line":"analyzing network traffic ingressing and egressing a VM. (ex. IDS)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_07f6e2d6","line":39,"in_reply_to":"1ae5cdf2_fedb464c","updated":"2014-06-13 14:41:23.000000000","message":"I have mentioned that below in the proposed changes section. will add the spec reference there.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"6f84945b903429c444d2e7662eee47f1bfb10097","unresolved":false,"context_lines":[{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"},{"line_number":42,"context_line":"analyzing network traffic ingressing and egressing a VM. (ex. IDS)."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_1cd9cd82","line":40,"updated":"2014-06-20 19:13:52.000000000","message":"There might be very minimum value to mirror traffic to Neutron CLI. Generally, the mirror traffic will need decoder/analyzer to show value to users. One option is to save to a file, like pcap file, etc.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"61d93b65762d369558ab7014c51bb1cfbd782011","unresolved":false,"context_lines":[{"line_number":37,"context_line":"mirroring traffic from one VM to another so that it can be useful to both"},{"line_number":38,"context_line":"administrators and tenants; future versions may address mirroring from a VM"},{"line_number":39,"context_line":"to an arbitrary interface on a compute host or on the network controller,"},{"line_number":40,"context_line":"or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility"},{"line_number":41,"context_line":"into VM network traffic which can be used for monitoring, debugging and"},{"line_number":42,"context_line":"analyzing network traffic ingressing and egressing a VM. (ex. IDS)."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_58326e5e","line":40,"in_reply_to":"1ae5cdf2_1cd9cd82","updated":"2014-06-22 17:03:59.000000000","message":"Yes... i must agree, getting the mirrored traffic to the CLI might not be much useful... i will amend this part in the next patch.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":68,"context_line":"be allowed to mirror the traffic from port(s) that they own on the shared"},{"line_number":69,"context_line":"network and not traffic from port that they do not own on the shared network."},{"line_number":70,"context_line":"So in essence tenants can only mirror traffic from port(s) that they own, even"},{"line_number":71,"context_line":"on a shared network."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":74,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_be91be48","line":71,"updated":"2014-06-13 09:33:06.000000000","message":"what about admin? I think we should be explicit here for clarity.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1cffe1e5faaa043290111e5c4609af0f81d5ee46","unresolved":false,"context_lines":[{"line_number":68,"context_line":"be allowed to mirror the traffic from port(s) that they own on the shared"},{"line_number":69,"context_line":"network and not traffic from port that they do not own on the shared network."},{"line_number":70,"context_line":"So in essence tenants can only mirror traffic from port(s) that they own, even"},{"line_number":71,"context_line":"on a shared network."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":74,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_3344d3b6","line":71,"in_reply_to":"1ae5cdf2_87303257","updated":"2014-06-16 08:57:03.000000000","message":"right exactly, it would be great to include the rationale as you have outlined it above... I just think it\u0027s good to be as explicit and specific as possible in these specs, especially for such a sensitive matter.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":68,"context_line":"be allowed to mirror the traffic from port(s) that they own on the shared"},{"line_number":69,"context_line":"network and not traffic from port that they do not own on the shared network."},{"line_number":70,"context_line":"So in essence tenants can only mirror traffic from port(s) that they own, even"},{"line_number":71,"context_line":"on a shared network."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":74,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_87303257","line":71,"in_reply_to":"1ae5cdf2_be91be48","updated":"2014-06-13 14:41:23.000000000","message":"An admin if allowed to mirror traffic from tenant networks can led to NSA as a Service :P... ideally the mirroring functionality should be available only to tenants on their virtual networks (However, the admin having the control over the data center can still mirror traffic on the physical switches). i will try to make this point explicit.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Tap-as-a-Serivce neutron port."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"In the first version of this service, the tenants can launch a VM on the"},{"line_number":79,"context_line":"neutron port that was created by instantiating the tap service to capture"},{"line_number":80,"context_line":"or analyze the mirrored traffic. In latter versions, the neutron port"},{"line_number":81,"context_line":"instantiated by the service can be used for purposes other than just launching"},{"line_number":82,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 to get"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_fe8186c3","line":79,"updated":"2014-06-13 09:33:06.000000000","message":"launch a VM specifying the resulting tap port id for the VM interface (--nic port-id\u003d_created_tap_port_uuid), thus receiving mirrored traffic for further processing (dependent on use case).","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Tap-as-a-Serivce neutron port."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"In the first version of this service, the tenants can launch a VM on the"},{"line_number":79,"context_line":"neutron port that was created by instantiating the tap service to capture"},{"line_number":80,"context_line":"or analyze the mirrored traffic. In latter versions, the neutron port"},{"line_number":81,"context_line":"instantiated by the service can be used for purposes other than just launching"},{"line_number":82,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 to get"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_677b26f5","line":79,"in_reply_to":"1ae5cdf2_fe8186c3","updated":"2014-06-13 14:41:23.000000000","message":"Thanks for the suggestion, the sentence look better and more clear. will change it.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":79,"context_line":"neutron port that was created by instantiating the tap service to capture"},{"line_number":80,"context_line":"or analyze the mirrored traffic. In latter versions, the neutron port"},{"line_number":81,"context_line":"instantiated by the service can be used for purposes other than just launching"},{"line_number":82,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 to get"},{"line_number":83,"context_line":"the mirrored data out from the tenant virtual network on a device or network"},{"line_number":84,"context_line":"not managed by openstack."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_be629e3b","line":82,"updated":"2014-06-13 09:33:06.000000000","message":"cool, perhaps ref Ieea08993f364415c56e3416b1d222101ce5d1ac9 is relevant","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":79,"context_line":"neutron port that was created by instantiating the tap service to capture"},{"line_number":80,"context_line":"or analyze the mirrored traffic. In latter versions, the neutron port"},{"line_number":81,"context_line":"instantiated by the service can be used for purposes other than just launching"},{"line_number":82,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 to get"},{"line_number":83,"context_line":"the mirrored data out from the tenant virtual network on a device or network"},{"line_number":84,"context_line":"not managed by openstack."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_c784fad4","line":82,"in_reply_to":"1ae5cdf2_be629e3b","updated":"2014-06-13 14:41:23.000000000","message":"sure, will add the reference.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":99,"context_line":"------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"As an alternative to introducing port mirroring functionality under neutron"},{"line_number":102,"context_line":"services, it could be added as an extension to the existing neutron v2 APIs."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_fecfc626","line":102,"updated":"2014-06-13 09:33:06.000000000","message":"I think given the potential for further work and expansion it would be better as a stand-alone plugin","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":99,"context_line":"------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"As an alternative to introducing port mirroring functionality under neutron"},{"line_number":102,"context_line":"services, it could be added as an extension to the existing neutron v2 APIs."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_07d8a2ed","line":102,"in_reply_to":"1ae5cdf2_fecfc626","updated":"2014-06-13 14:41:23.000000000","message":"yes...","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":151,"context_line":"| tap_service_id | UUID   | CR, all  | N/A       | Valid tap     | UUID of the tap         |"},{"line_number":152,"context_line":"|                |        |          |           | service UUID  | service instance.       |"},{"line_number":153,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":154,"context_line":"| source_port    | UUID   | CR, all  | N/A       | UUID of a     | UUID of the neutron     |"},{"line_number":155,"context_line":"|                |        |          |           | valid neutron | port that needed to be  |"},{"line_number":156,"context_line":"|                |        |          |           | port          | mirrored                |"},{"line_number":157,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_def3ea70","line":154,"updated":"2014-06-13 09:33:06.000000000","message":"are we definitely limiting this to 1 source port only for v 1 (likely I missed it earlier) - why not just go ahead and make this source_ports [] from now?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1cffe1e5faaa043290111e5c4609af0f81d5ee46","unresolved":false,"context_lines":[{"line_number":151,"context_line":"| tap_service_id | UUID   | CR, all  | N/A       | Valid tap     | UUID of the tap         |"},{"line_number":152,"context_line":"|                |        |          |           | service UUID  | service instance.       |"},{"line_number":153,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":154,"context_line":"| source_port    | UUID   | CR, all  | N/A       | UUID of a     | UUID of the neutron     |"},{"line_number":155,"context_line":"|                |        |          |           | valid neutron | port that needed to be  |"},{"line_number":156,"context_line":"|                |        |          |           | port          | mirrored                |"},{"line_number":157,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_f367cb4f","line":154,"in_reply_to":"1ae5cdf2_6a84cb5d","updated":"2014-06-16 08:57:03.000000000","message":"thanks for the explanation vinay, of course that makes sense, sorry for the noise ;)","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":151,"context_line":"| tap_service_id | UUID   | CR, all  | N/A       | Valid tap     | UUID of the tap         |"},{"line_number":152,"context_line":"|                |        |          |           | service UUID  | service instance.       |"},{"line_number":153,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":154,"context_line":"| source_port    | UUID   | CR, all  | N/A       | UUID of a     | UUID of the neutron     |"},{"line_number":155,"context_line":"|                |        |          |           | valid neutron | port that needed to be  |"},{"line_number":156,"context_line":"|                |        |          |           | port          | mirrored                |"},{"line_number":157,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_6a84cb5d","line":154,"in_reply_to":"1ae5cdf2_def3ea70","updated":"2014-06-13 14:41:23.000000000","message":"We are not limiting the number of source ports that a tenant can mirror. If the tenant wants to mirror multiple source ports, he will have to create multiple tap flow instances, one for each source port he wants to mirror, that is the idea.\n\nSo it was either multiple tap flow instances, each with one source port or a list of source_ports in one tap flow instance, and we chose the former option.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":7591,"name":"Kanzhe Jiang","email":"kanzhe@gmail.com","username":"kanzhe"},"change_message_id":"4a5260f7b0a33c51a7373dd35630c0bbb254862c","unresolved":false,"context_lines":[{"line_number":192,"context_line":"                          \u0027is_visible\u0027: True, \u0027default\u0027: \u0027\u0027},"},{"line_number":193,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":194,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":195,"context_line":"                               \u0027is_visible\u0027: True},"},{"line_number":196,"context_line":"          \u0027network_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":197,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":198,"context_line":"                               \u0027is_visible\u0027: False}"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_72c77e45","line":195,"updated":"2014-06-12 19:50:17.000000000","message":"Any plan to incorporate serviceInsertion proposal? If so, then there is no need to include port_id and network_id. The tap service instance can be inserted through the insertion API and get an serviceAttachmentPoint.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":7591,"name":"Kanzhe Jiang","email":"kanzhe@gmail.com","username":"kanzhe"},"change_message_id":"c767b7d803b06ed031a2279f76cec7cb48cdfe8f","unresolved":false,"context_lines":[{"line_number":192,"context_line":"                          \u0027is_visible\u0027: True, \u0027default\u0027: \u0027\u0027},"},{"line_number":193,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":194,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":195,"context_line":"                               \u0027is_visible\u0027: True},"},{"line_number":196,"context_line":"          \u0027network_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":197,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":198,"context_line":"                               \u0027is_visible\u0027: False}"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_ddf71058","line":195,"in_reply_to":"1ae5cdf2_68a85820","updated":"2014-06-17 05:37:59.000000000","message":"It would be a good idea to list the integration with serviceInsertion as a follow up work. It would avoid any confusion.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4a0703ce70a70f4d8fb67dc59b170564de1861f5","unresolved":false,"context_lines":[{"line_number":192,"context_line":"                          \u0027is_visible\u0027: True, \u0027default\u0027: \u0027\u0027},"},{"line_number":193,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":194,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":195,"context_line":"                               \u0027is_visible\u0027: True},"},{"line_number":196,"context_line":"          \u0027network_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":197,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":198,"context_line":"                               \u0027is_visible\u0027: False}"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_68a85820","line":195,"in_reply_to":"1ae5cdf2_72c77e45","updated":"2014-06-13 13:25:34.000000000","message":"Absolutely Kanzhe! that is the ultimate idea. We want the TaaS also to be incorporated with the service insertion proposal similar to FWaaS, LBaaS, VPNaaS.\n\nWe will eventually remove the port_id and network_id from the data model once TaaS is ready can be driven from service insertion framework.\n\nWe would like to retain the port_id and netowrk_id for now, to be able to continue our development work on the TaaS and bring to it life as a service first (first version roll-out) and then remove the port_id and network_id when service insertion is ready for TaaS to be integrated into it.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1cffe1e5faaa043290111e5c4609af0f81d5ee46","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Security impact"},{"line_number":223,"context_line":"---------------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":226,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":227,"context_line":"usually is destined to a VM that is not the same as the VM attached on"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_73cadb1b","line":224,"updated":"2014-06-16 08:57:03.000000000","message":"perhaps you can also add a note here about the \u0027no admin creation of tap service because NSAaaS bla ... and for that reason tap service creation is only allowed for ports that are owned by the creating tenant\u0027","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"6f84945b903429c444d2e7662eee47f1bfb10097","unresolved":false,"context_lines":[{"line_number":232,"context_line":"outbound security filters. The source mirror ports should therefore"},{"line_number":233,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":234,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":235,"context_line":"application of outbound filters."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":238,"context_line":"being mirrored, then the port security on that port also needs to be disabled"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_3c7e89af","line":235,"updated":"2014-06-20 19:13:52.000000000","message":"The network analyzer would like to get all the traffic on some specific network interface, including those traffic that is rejected by inbound security filters. It might be better to have the logical spot located before the application of inbound filters. By the way, what will be the case if this will be implemented by OVS port mirroring ?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"61d93b65762d369558ab7014c51bb1cfbd782011","unresolved":false,"context_lines":[{"line_number":232,"context_line":"outbound security filters. The source mirror ports should therefore"},{"line_number":233,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":234,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":235,"context_line":"application of outbound filters."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":238,"context_line":"being mirrored, then the port security on that port also needs to be disabled"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_387da2e7","line":235,"in_reply_to":"1ae5cdf2_3c7e89af","updated":"2014-06-22 17:03:59.000000000","message":"Agreed... going forward this would what we want to achieve, but for the first version (reference implementation) based on OVS we will focus on getting the traffic mirrored at the OVS Port. But latter plugins can build on it and have a logical spot before the security group filters.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"6f84945b903429c444d2e7662eee47f1bfb10097","unresolved":false,"context_lines":[{"line_number":242,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":243,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":244,"context_line":"outbound filters should apply as normal."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Notifications impact"},{"line_number":247,"context_line":"--------------------"},{"line_number":248,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_5027b9b5","line":245,"updated":"2014-06-20 19:13:52.000000000","message":"Will the destination port be the dedicated port for port mirroring ? Should it allow to have traffic coming out of it ?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"61d93b65762d369558ab7014c51bb1cfbd782011","unresolved":false,"context_lines":[{"line_number":242,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":243,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":244,"context_line":"outbound filters should apply as normal."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Notifications impact"},{"line_number":247,"context_line":"--------------------"},{"line_number":248,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_7883aaca","line":245,"in_reply_to":"1ae5cdf2_5027b9b5","updated":"2014-06-22 17:03:59.000000000","message":"Yes the destination port for mirrored data will be a dedicated port, and it is created when the tenant creates a \u0027Tap_Service\u0027 instance.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":255,"context_line":"------------------"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"The performance impact of mirroring traffic needs to be examined and"},{"line_number":258,"context_line":"qunatified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":259,"context_line":"all ports could be large and needs more examination."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Some alternative to reduce the amount of mirrored traffic."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_5e86fab9","line":258,"updated":"2014-06-13 09:33:06.000000000","message":"quantified","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":255,"context_line":"------------------"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"The performance impact of mirroring traffic needs to be examined and"},{"line_number":258,"context_line":"qunatified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":259,"context_line":"all ports could be large and needs more examination."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Some alternative to reduce the amount of mirrored traffic."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_87f3d271","line":258,"in_reply_to":"1ae5cdf2_5e86fab9","updated":"2014-06-13 14:41:23.000000000","message":"will change","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":258,"context_line":"qunatified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":259,"context_line":"all ports could be large and needs more examination."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Some alternative to reduce the amount of mirrored traffic."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"  1. Rate limiting on the ports being mirrored."},{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_feb42683","line":261,"updated":"2014-06-13 09:33:06.000000000","message":"alternatives","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":258,"context_line":"qunatified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":259,"context_line":"all ports could be large and needs more examination."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Some alternative to reduce the amount of mirrored traffic."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"  1. Rate limiting on the ports being mirrored."},{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_e703b63f","line":261,"in_reply_to":"1ae5cdf2_feb42683","updated":"2014-06-13 14:41:23.000000000","message":"will change","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"0f73dc5d241a2ee1aed72229335e197bd53dbac9","unresolved":false,"context_lines":[{"line_number":263,"context_line":"  1. Rate limiting on the ports being mirrored."},{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."},{"line_number":265,"context_line":"  3. Having a qouta on the number of TaaS Flows that can be defined by the"},{"line_number":266,"context_line":"     tenant."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Other deployer impact"},{"line_number":269,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_9e288298","line":266,"updated":"2014-06-13 09:33:06.000000000","message":"I think its great you\u0027ve called these out above but I don\u0027t think it\u0027s worth investigating this unless it becomes a performance issue. But that imo is also a moot point since the tenant is fully in control of how many TapFlows he has created. IMO let\u0027s see what it looks like in practice and perhaps just document it.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"ddb60600e7de22ab7deee49cbdf72d3dc8d8c0c8","unresolved":false,"context_lines":[{"line_number":263,"context_line":"  1. Rate limiting on the ports being mirrored."},{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."},{"line_number":265,"context_line":"  3. Having a qouta on the number of TaaS Flows that can be defined by the"},{"line_number":266,"context_line":"     tenant."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Other deployer impact"},{"line_number":269,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_27a83e1f","line":266,"in_reply_to":"1ae5cdf2_9e288298","updated":"2014-06-13 14:41:23.000000000","message":"yes","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"e36c8415d7b1c31800b303635beefc2250f4e057","unresolved":false,"context_lines":[{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."},{"line_number":265,"context_line":"  3. Having a qouta on the number of TaaS Flows that can be defined by the"},{"line_number":266,"context_line":"     tenant."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Other deployer impact"},{"line_number":269,"context_line":"---------------------"},{"line_number":270,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_2d69fd8b","line":267,"updated":"2014-06-20 16:09:31.000000000","message":"Another point is from the implementation point of view. If this will be implemented by OVS port mirroring, I think there is no filtering support there (not counting Up/Down direction as filtering here). To introduce any filtering on OVS port mirroring, design may have to work on the OVS flow table directly.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"61d93b65762d369558ab7014c51bb1cfbd782011","unresolved":false,"context_lines":[{"line_number":264,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."},{"line_number":265,"context_line":"  3. Having a qouta on the number of TaaS Flows that can be defined by the"},{"line_number":266,"context_line":"     tenant."},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Other deployer impact"},{"line_number":269,"context_line":"---------------------"},{"line_number":270,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_3864c247","line":267,"in_reply_to":"1ae5cdf2_2d69fd8b","updated":"2014-06-22 17:03:59.000000000","message":"Exactly... to implement filtering in OVS based reference implementation, we have to work on the flow tables directly.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"e36c8415d7b1c31800b303635beefc2250f4e057","unresolved":false,"context_lines":[{"line_number":282,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":283,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":284,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"Assignee(s)"},{"line_number":287,"context_line":"-----------"},{"line_number":288,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_0dac4134","line":285,"updated":"2014-06-20 16:09:31.000000000","message":"Any plan on how neutron CLI will look like for this feature ?","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"61d93b65762d369558ab7014c51bb1cfbd782011","unresolved":false,"context_lines":[{"line_number":282,"context_line":"The implementation will leverage the port mirroring feature in OVS to"},{"line_number":283,"context_line":"accomplish this. To transfer mirrored data across OVS switches in different"},{"line_number":284,"context_line":"physical server, an out of band GRE tunnel will be used."},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"Assignee(s)"},{"line_number":287,"context_line":"-----------"},{"line_number":288,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_18c8e620","line":285,"in_reply_to":"1ae5cdf2_0dac4134","updated":"2014-06-22 17:03:59.000000000","message":"we are planing that... but as with your previous comment, there might be minimal or no value in sending the mirrored data to the CLI and that can be taken off the table\n\nThe CLI would allow the tenant to create \u0027Tap_Service\u0027 instances and associate neutron ports to be mirrored by creating a \u0027Tap_Flow\u0027.\n\nTenants can list Tap_Service instance(s) that they own using the CLI, They can list the \u0027Tap_Flow\u0027(s) that they have created.","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1cffe1e5faaa043290111e5c4609af0f81d5ee46","unresolved":false,"context_lines":[{"line_number":290,"context_line":""},{"line_number":291,"context_line":"Work Items"},{"line_number":292,"context_line":"----------"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"* TaaS API and data model implementation."},{"line_number":295,"context_line":"* TaaS OVS driver."},{"line_number":296,"context_line":"* OVS agent changes for port mirroring."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_f3834ba7","line":293,"updated":"2014-06-16 08:57:03.000000000","message":"please shout if you need an extra pair of hands (or even just ping for reviews/testing etc), switchport mirroring is something that I got to play with a few years back and I find this spec very interesting. thanks!","commit_id":"462d6145637d04fddbff95a08095cc2747218166"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Tap-as-a-Service for Neutron"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"URL of the launchpad blueprint:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_2c2ffdf7","line":8,"updated":"2014-07-16 16:42:09.000000000","message":"TaaS? Is this name really necessary? I think this may confuse people as what it really means. Why not simply \u0027Port Mirroring Capabilities\u0027? It\u0027s clear and well understood.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Tap-as-a-Service for Neutron"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"URL of the launchpad blueprint:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_ed86dc15","line":8,"in_reply_to":"baada198_2c2ffdf7","updated":"2014-07-16 19:44:16.000000000","message":"\"Tap-as-a-Service\" was chosen because we feel it is a generic (enough) name for such a feature. It should be noted that although we plan to rely port-mirroring in the first implementation, other techniques may be used down the line or in special deployment scenarios to realize the same capabilities.\n\nExposing this as a service (as opposed to an API extension) will provide greater flexibility in supporting more advanced functionality in future versions.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"c59f82cf4ea85474db66e64854051bf3ade3594d","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Tap-as-a-Service for Neutron"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"URL of the launchpad blueprint:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6693c95c","line":8,"in_reply_to":"baada198_ed86dc15","updated":"2014-07-16 20:20:22.000000000","message":"I\u0027d rather start with small iterations. If the first implementation is just about port-mirroring then this is what this BP should be about.\n\nApproving this BP for Juno as is is going to give the impression that by the release date the grander plan is going to be complete, which it isn\u0027t.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_ec018507","line":15,"updated":"2014-07-16 16:42:09.000000000","message":"Taking the comments below into consideration I think it\u0027s important at this stage to clarify what egress and ingress actually mean in this context.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"c59f82cf4ea85474db66e64854051bf3ade3594d","unresolved":false,"context_lines":[{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_a69de168","line":15,"in_reply_to":"baada198_2daff47e","updated":"2014-07-16 20:20:22.000000000","message":"Right, I am saying we should spell that out in the BP.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":12,"context_line":"https://blueprints.launchpad.net/neutron/+spec/port-mirroring"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"},{"line_number":15,"context_line":"neutron.  Port mirroring allows sending a copy of packets ingressing or"},{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_2daff47e","line":15,"in_reply_to":"baada198_ec018507","updated":"2014-07-16 19:44:16.000000000","message":"In the context of this discussion \u0027ingress\u0027 refers to \u0027entering a VM\u0027 while egress refers to \u0027leaving a VM\u0027.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"9f430f499ab4c249f743784ad7fdff3f8ed08f89","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_05f00d65","line":19,"updated":"2014-06-25 15:31:28.000000000","message":"What are the ingress and egress refering to, switch or VM instance ? If it is from the perspective of VM ( ingressing for traffic into VM and egressing for traffic out of VM), IMHO, the application of security group filters on port mirroring should work in the opposite way as stated here.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"1f620bd50a5b334b9254211859ed7a0aa4a52396","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8c588afa","line":19,"in_reply_to":"1ae5cdf2_047c58b5","updated":"2014-06-26 21:44:00.000000000","message":"For the first version, we\u0027d like to limit the scope of the implementation to tapping the  traffic that \"actually\" enters or leaves a VM (via its vNICs). This is a minimum requirement in order to say that we are able to fully monitor all VM network activity. Since traffic entering a VM\u0027s vNIC has already passed the inbound Security Group filter we would like to tap after the inbound filter; similarly since traffic leaving a VM\u0027s vNIC has not yet passed the outbound Security Group filter we would like to tap before the outbound filter.\n\nIn subsequent versions, we can also add support for  capturing packets before the inbound Security Group filter and after the outbound Security Group filter, just like you have suggested.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"51e8a07633f68d0c47d1211c1d8452cb06bd474d","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_58d4b3ba","line":19,"in_reply_to":"1ae5cdf2_05f00d65","updated":"2014-06-25 17:34:40.000000000","message":"We are trying to provide ability to capture all of the traffic that enters a VM (ingress) or leaves a VM (egress). This is the reason why we would like the Tap (port) to be applied after the application of inbound Security Group filters (for traffic coming toward the VM) and before the application of Security Group filters (for traffic leaving the VM.\n\nPlease note that our main goal is not debugging Neutron networking or the operation of Security Group filters. Rather, we are interested in monitoring network traffic that arrives at or leaves a VM. Therefore, the application of Security Group filters on port-mirroring as stated here is correct.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"a17c8d1ba62b13a304c1a61f08ace60462032821","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a96d3d05","line":19,"in_reply_to":"1ae5cdf2_0bcd6d86","updated":"2014-06-26 18:58:43.000000000","message":"We don\u0027t plan on (re)implementing port-mirroring in OpenStack at the Neutron level. This is the job of the underlying edge switch and for the reference implementation we will be using Open vSwitch for this purpose. OVS, as it turns out, already supports SPAN based port-mirroring, as well as the capability to mirror to a tunnel port, which will allow us to direct tapped traffic to a destination Neutron port that many be residing on a different compute node.\n\nAt the Neutron level, we plan to add additional logic so that when a tenant is instantiating TasS, the resulting port-mirror sessions are restricted to the virtual networks owned by the tenant. In the case of shared networks, only ports owned by the tenant will be allowed to participate in the TasS session.\n\nIt should be possible to extend the spec to other virtual switches that support port-mirroring (e.g. vNetwork Distributed Switch in the case of vSphere/ESX based OpenStack deployments). Similarly, it should also be possible to support SR-IOV hardware in the future (Intel Niantics have port-mirroring capability).","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"5404fe97a3ba5f86781b23d299303dfbabadfac5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0bcd6d86","line":19,"in_reply_to":"1ae5cdf2_58d4b3ba","updated":"2014-06-25 22:05:35.000000000","message":"All right, your response explains the idea behind the content. However, I will like to point out that the port mirroring is traditionally the feature of network switches and routers. SPAN/RSPAN/ERSPAN are some well-known industry standards. Will we rather do something differently here or simply follow some well-known standards and practices?  \n\nIs it possible to implement that in Openstack now ?  I am assuming that this will be implemented through OVS.\n\nTo look in future, what happen this has to get support from physical switches, such as the case under SR-IOV, which skips the virtual switches completely within the host machine. Will that be possible to realize the spec here ?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"0c970eba53668d6bc3ee5b23ffd79557c66caa4e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_1035e3f6","line":19,"in_reply_to":"1ae5cdf2_8584c1b1","updated":"2014-07-16 19:31:34.000000000","message":"In this case, should the spec be modified to reflect what it is going to do ?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"9b9df5f4a71e428b33b29fda62225e7f224cf478","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_d66e94c7","line":19,"in_reply_to":"1ae5cdf2_8c588afa","updated":"2014-06-27 06:06:46.000000000","message":"OK, I noticed that Security Groups are (still) implemented via Linux IP tables between the VM and OVS. Somehow I was under the impression that we already have OVS based Security Groups in Open Stack Icehouse.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":6932,"name":"Adrian Hoban","email":"adrian.hoban@intel.com","username":"adrian-hoban"},"change_message_id":"f60ef6df1f0df60c1bbad9de5f1ad18726df67ce","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa98f980_d534474c","line":19,"in_reply_to":"1ae5cdf2_a96d3d05","updated":"2014-09-08 16:53:40.000000000","message":"If it is desirable to enable a path to leverage port mirroring hardware, then the example given related to SR-IOV may require some additional considerations for the security group requirements. In the SR-IOV model where you do a direct assignment to the VM, the IP Tables based security groups applied to OVS ports are by-passed. \nSo, if the port that the tenant wants to mirror is an SR-IOV direct assigned port (VNIC_DIRECT) then you may need a security group exception or consider alternatives.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"1517be238979e507202945d43e52788171633a7e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_047c58b5","line":19,"in_reply_to":"1ae5cdf2_a96d3d05","updated":"2014-06-26 19:26:22.000000000","message":"If you are planning to use port mirroring from ovs or other virtual/physical switches to implement this spec, will it be possible to support \"From the source VM’s perspective, mirrored ingress packets are captured after passing the inbound Security Group filter. Mirrored egress packets are captured before passing the outbound Security Group filter\" ?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"3168735b7b4f1b0812f13123f256fa142e4c1d98","unresolved":false,"context_lines":[{"line_number":16,"context_line":"egressing (or both) one port to another port (usually distinct from the"},{"line_number":17,"context_line":"packet’s destination). From the source VM’s perspective, mirrored ingress"},{"line_number":18,"context_line":"packets are captured after passing the inbound Security Group filter."},{"line_number":19,"context_line":"Mirrored egress packets are captured before passing the outbound Security"},{"line_number":20,"context_line":"Group filter. All captured packets are forwarded to the mirror’s destination"},{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8584c1b1","line":19,"in_reply_to":"1ae5cdf2_d66e94c7","updated":"2014-06-27 16:49:11.000000000","message":"Given how Security Groups work today, we can have the first TasS implementation focus on port-level mirroring. Later versions can evolve into providing full support from a VM\u0027s perspective.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_8f38fbd5","line":24,"updated":"2014-07-16 16:42:09.000000000","message":"I still don\u0027t understand why. Can you elaborate as to why we need the aaS suffix?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"63ecfacb80073e1f3f47a53c1fdc8f0a68e056e5","unresolved":false,"context_lines":[{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_46cec5b5","line":24,"in_reply_to":"baada198_0d64f047","updated":"2014-07-16 20:03:22.000000000","message":"I agree with the consistency point. If we drop the aaS from VPNaaS, LBaaS, and FWaaS then we should drop if from TaaS. If we retain the aaS on those others then we should have it here for consistency. From an operator perspective I view TaaS as a tenant level capability that should be pretty much at a parity with VPNaaS, LBaaS and FWaaS from a UI perspective.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"c59f82cf4ea85474db66e64854051bf3ade3594d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_06e12dd0","line":24,"in_reply_to":"baada198_0d64f047","updated":"2014-07-16 20:20:22.000000000","message":"as a Service doesn\u0027t not mean anything. In this spec you are talking about port mirroring and I don\u0027t seen anything that would justify the reason of creating many tenant-isolated instances of active services that are used to  manage mirrored ports, this sounds like an overkill to me. We don\u0027t have Port As a Service do we?\n\nI appreciate that the long-term view may change, but if the work scoped for Juno is gonna be a lot smaller (or made of smaller pieces) then this BP should be broken down into smaller BP\u0027s and each one should be reviewed/approved separately.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"c59f82cf4ea85474db66e64854051bf3ade3594d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_66d909f4","line":24,"in_reply_to":"baada198_46cec5b5","updated":"2014-07-16 20:20:22.000000000","message":"I guess that\u0027s largely a matter of taste. I personally don\u0027t think that people refer to Neutron as Network as a Server, but just Neutron. Maybe these advanced services should have codenames (and I think LB does) so that we can avoid confusion, and stop this aas nonsense.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":21,"context_line":"port without passing through its inbound filters."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":24,"context_line":"service called \u0027Tap-as-a-Service\u0027."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0d64f047","line":24,"in_reply_to":"baada198_8f38fbd5","updated":"2014-07-16 19:44:16.000000000","message":"As mentioned above, we would like to expose this capability as a service to allow for easier expansion of capabilities in the future.\n\nThe aaS suffix has been added to conform with other Neutron services such as VPNaaS, LBaaS, etc.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":31,"context_line":"in tenant networks. This feature could be of benefit to tenants who would"},{"line_number":32,"context_line":"like to debug, monitor and analyze (ex. IDS) traffic in their virtual"},{"line_number":33,"context_line":"networks. This neutron spec proposes to introduce the feature of port"},{"line_number":34,"context_line":"mirroring by adding a new service called Tap-as-a-Service."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_af3cdfc0","line":34,"updated":"2014-07-16 16:42:09.000000000","message":"This last statement seems redundant as it\u0027s just been mentioned on line 24","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"in tenant networks. This feature could be of benefit to tenants who would"},{"line_number":32,"context_line":"like to debug, monitor and analyze (ex. IDS) traffic in their virtual"},{"line_number":33,"context_line":"networks. This neutron spec proposes to introduce the feature of port"},{"line_number":34,"context_line":"mirroring by adding a new service called Tap-as-a-Service."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0df2306f","line":34,"in_reply_to":"baada198_af3cdfc0","updated":"2014-07-16 19:44:16.000000000","message":"OK.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11208,"name":"Baohua Yang","email":"baohua@linux.vnet.ibm.com","username":"yangbaohua"},"change_message_id":"6eb977c587785f6d411f394fa70b41d31beef037","unresolved":false,"context_lines":[{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"},{"line_number":38,"context_line":"mirroring traffic from one neutron port to another; future versions may"},{"line_number":39,"context_line":"address mirroring from a neutron port to an arbitrary interface on a"},{"line_number":40,"context_line":"compute host or on the network controller. Mirroring traffic has many uses,"},{"line_number":41,"context_line":"it provides visibility into VM network traffic which can be used for"},{"line_number":42,"context_line":"monitoring, debugging and analyzing network traffic ingressing and egressing a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_54acc835","line":39,"updated":"2014-07-09 05:53:53.000000000","message":"Although tap is popular in current openstack, however, the term port may be more accurate. \nAlso as indicated here, we do not care the operation object but the function.\nTaos is easy to get confusing.\nSo, why not take the name as Mirroring as a Service (MaaS)?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"},{"line_number":38,"context_line":"mirroring traffic from one neutron port to another; future versions may"},{"line_number":39,"context_line":"address mirroring from a neutron port to an arbitrary interface on a"},{"line_number":40,"context_line":"compute host or on the network controller. Mirroring traffic has many uses,"},{"line_number":41,"context_line":"it provides visibility into VM network traffic which can be used for"},{"line_number":42,"context_line":"monitoring, debugging and analyzing network traffic ingressing and egressing a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6d872cb7","line":39,"in_reply_to":"baada198_0f730bb5","updated":"2014-07-16 19:44:16.000000000","message":"That is just a matter of convention as explained above, so as to look similar to other Neutron services.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"76300c994f355c9b08669212786506e952410cb4","unresolved":false,"context_lines":[{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"},{"line_number":38,"context_line":"mirroring traffic from one neutron port to another; future versions may"},{"line_number":39,"context_line":"address mirroring from a neutron port to an arbitrary interface on a"},{"line_number":40,"context_line":"compute host or on the network controller. Mirroring traffic has many uses,"},{"line_number":41,"context_line":"it provides visibility into VM network traffic which can be used for"},{"line_number":42,"context_line":"monitoring, debugging and analyzing network traffic ingressing and egressing a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_5c5c427d","line":39,"in_reply_to":"baada198_54acc835","updated":"2014-07-14 15:50:59.000000000","message":"why we don\u0027t just drop \"as a service\" which does not mean anything?\n\nUnless we feel a need for catchy names of the aas suffix make things look cooler, to me this is just a port mirroring extension.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":36,"context_line":"The use-case is to debug network traffic by \"tapping\" or \"mirroring\""},{"line_number":37,"context_line":"packets traversing a neutron port. This neutron spec focuses on"},{"line_number":38,"context_line":"mirroring traffic from one neutron port to another; future versions may"},{"line_number":39,"context_line":"address mirroring from a neutron port to an arbitrary interface on a"},{"line_number":40,"context_line":"compute host or on the network controller. Mirroring traffic has many uses,"},{"line_number":41,"context_line":"it provides visibility into VM network traffic which can be used for"},{"line_number":42,"context_line":"monitoring, debugging and analyzing network traffic ingressing and egressing a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0f730bb5","line":39,"in_reply_to":"baada198_5c5c427d","updated":"2014-07-16 16:42:09.000000000","message":"++","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Proposed change"},{"line_number":53,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The proposal is to add a new neutron service \u0027Tap-as-a-Service\u0027 in order to"},{"line_number":56,"context_line":"enable the functionality of tapping/mirroring traffic inside tenant networks in"},{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0f9a2bc5","line":55,"updated":"2014-07-16 16:42:09.000000000","message":"ok I think that\u0027s clear by now, no need to reiterate this again.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The proposal is to add a new neutron service \u0027Tap-as-a-Service\u0027 in order to"},{"line_number":56,"context_line":"enable the functionality of tapping/mirroring traffic inside tenant networks in"},{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The proposed service would allow the tenants to create a tap service instance"},{"line_number":61,"context_line":"to which they can add neutron ports that need to be mirrored by creating tap"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0fb94bec","line":58,"updated":"2014-07-16 16:42:09.000000000","message":"Why do we need an extra service for creating and hosting ports? Neutron already does that! As a matter of fact today neutron-debug gives up the ability to create so called \u0027probes\u0027, I see they could be used (with minor tweaks under the hood) to capture traffic in/out other ports to which they have visibility.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The proposal is to add a new neutron service \u0027Tap-as-a-Service\u0027 in order to"},{"line_number":56,"context_line":"enable the functionality of tapping/mirroring traffic inside tenant networks in"},{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The proposed service would allow the tenants to create a tap service instance"},{"line_number":61,"context_line":"to which they can add neutron ports that need to be mirrored by creating tap"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_70e53f09","line":58,"in_reply_to":"baada198_0fb94bec","updated":"2014-07-16 19:44:16.000000000","message":"TaaS is designed to streamline the process of establishing traffic monitoring sessions, which honor tenant boundaries. Aside from being a debugging aid for trouble-shooting Neutron networking issues, we see this as an enabler for supporting traffic monitoring applications intended for security, analytics, etc. In the future, TaaS can be extended in several ways to provide additional capabilities.\n\nA TaaS instance will represent one monitoring session. The destination side port may be hooked to a monitoring VM, while source ports belonging to VMs that one intends to monitor, may be added/removed from the TaaS session.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The proposed service would allow the tenants to create a tap service instance"},{"line_number":61,"context_line":"to which they can add neutron ports that need to be mirrored by creating tap"},{"line_number":62,"context_line":"flows. The tap service itself will be a neutron port, which will be the"},{"line_number":63,"context_line":"destination port for the mirrored traffic."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_4faa6386","line":60,"updated":"2014-07-16 16:42:09.000000000","message":"last time I checked that service was Neutron itself!","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"63ecfacb80073e1f3f47a53c1fdc8f0a68e056e5","unresolved":false,"context_lines":[{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The proposed service would allow the tenants to create a tap service instance"},{"line_number":61,"context_line":"to which they can add neutron ports that need to be mirrored by creating tap"},{"line_number":62,"context_line":"flows. The tap service itself will be a neutron port, which will be the"},{"line_number":63,"context_line":"destination port for the mirrored traffic."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_e64b595d","line":60,"in_reply_to":"baada198_4faa6386","updated":"2014-07-16 20:03:22.000000000","message":"Armando, If you know how to mirror a port using current Neutron API please share. Note that this isn\u0027t just an interface of type tap, this is about allowing a tenant to activate a packet duplication functionality. This is not about someone with administrative access to the underlying OpenStack environment. The point of tap \"as a service\" is to allow a tenant to attach a virtual \"splitter\" to the virtual \"wire\" that\u0027s plugged into their virtual NIC and get a copy of all the Ethernet frames sent to a second destination while those frames still flow to their normal destination. If this is \"Neutron itself\" as it already exists I\u0027d like to know where that\u0027s documented because I haven\u0027t seen it anywhere.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":57,"context_line":"neutron. This service will be modeled similar to other services in neutron"},{"line_number":58,"context_line":"like the firewall, loadbalancer, l3 router etc."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The proposed service would allow the tenants to create a tap service instance"},{"line_number":61,"context_line":"to which they can add neutron ports that need to be mirrored by creating tap"},{"line_number":62,"context_line":"flows. The tap service itself will be a neutron port, which will be the"},{"line_number":63,"context_line":"destination port for the mirrored traffic."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_90c9f37b","line":60,"in_reply_to":"baada198_4faa6386","updated":"2014-07-16 19:44:16.000000000","message":"I would have to politely disagree. I don\u0027t believe Neutron today has TaaS capability as described in this spec.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":70,"context_line":"network and not traffic from port that they do not own on the shared network."},{"line_number":71,"context_line":"So in essence tenants can only mirror traffic from port(s) that they own, even"},{"line_number":72,"context_line":"on a shared network."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":75,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":76,"context_line":"traffic from any port(s) that belong to tenants."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_f0786ffa","line":73,"updated":"2014-07-09 19:11:25.000000000","message":"Could this be one of the action targets from Group Policy? GBP allows redirect today. Could tap be added as an action?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":70,"context_line":"network and not traffic from port that they do not own on the shared network."},{"line_number":71,"context_line":"So in essence tenants can only mirror traffic from port(s) that they own, even"},{"line_number":72,"context_line":"on a shared network."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":75,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":76,"context_line":"traffic from any port(s) that belong to tenants."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_edc1bf2f","line":73,"in_reply_to":"baada198_f0786ffa","updated":"2014-07-15 13:02:50.000000000","message":"Having gone through the GBP, yes we can add tap as an action under GBP.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"ba70439605b30abf6bcf1f1cb71fe11a0b640c3d","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":75,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":76,"context_line":"traffic from any port(s) that belong to tenants."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":79,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_aec1f355","line":76,"updated":"2014-07-03 11:30:40.000000000","message":"Thanks for including this Vinay, imo it is really important. Clearly it is but a gesture as anyone with an engineer can run their own custom neutron to do this. BUT, we are i) being open and explicit and what\u0027s more documenting that we have considered this issue and ii) we draw a line in the sand and say we don\u0027t support NSAaaS out of the box :)","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":75,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":76,"context_line":"traffic from any port(s) that belong to tenants."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":79,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_98279f62","line":76,"in_reply_to":"baada198_108de331","updated":"2014-07-15 13:02:50.000000000","message":"In our opinion, the cloud operator can spoof traffic on the hardware switches or by hacking into virtual switches directly anyways (might be for debugging or really NSA type spoofing :) ). The TaaS however can stay clear of this by offering its service only be used by the Tenant on ports they own, and hence putting to rest any doubts that this might be open to misuse.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":490,"name":"Sumit Naiksatam","email":"sumitnaiksatam@gmail.com","username":"snaiksat"},"change_message_id":"0e08be835c3274eb239fb40763e670a4372c83c2","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":75,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":76,"context_line":"traffic from any port(s) that belong to tenants."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The port(s) owned by the tenant that are mirrored can be on network(s) other"},{"line_number":79,"context_line":"than the network on which tap service port is created. This allow the tenant"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_108de331","line":76,"in_reply_to":"baada198_aec1f355","updated":"2014-07-09 17:26:14.000000000","message":"This should perhaps be controlled in policy.json? The operator can then publish what he supports.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":80,"context_line":"to mirror traffic from any port(s) it owns on any network(s) on to the same"},{"line_number":81,"context_line":"Tap-as-a-Serivce neutron port."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":84,"context_line":"the tap port id (resulting from the creation of tap service) for the VM"},{"line_number":85,"context_line":"interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":86,"context_line":"further processing (dependent on use case).In latter versions, the neutron port"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_efa89779","line":83,"updated":"2014-07-16 16:42:09.000000000","message":"I am confused here: why would the existing boot workflow be altered by this extension? I\u0027d want to boot a VM the usual way and then mark its port for mirroring; this in turn will result in the creation of a mirror port that can be used for IDS, and the other use cases etc. How the mirror port is actually used I think it\u0027s beyond the scope of this bp.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":80,"context_line":"to mirror traffic from any port(s) it owns on any network(s) on to the same"},{"line_number":81,"context_line":"Tap-as-a-Serivce neutron port."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":84,"context_line":"the tap port id (resulting from the creation of tap service) for the VM"},{"line_number":85,"context_line":"interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":86,"context_line":"further processing (dependent on use case).In latter versions, the neutron port"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_d07c4bb8","line":83,"in_reply_to":"baada198_efa89779","updated":"2014-07-16 19:44:16.000000000","message":"What is being referred to here is the process of attaching the \"monitoring VM\" to the destination port belonging to a TaaS instance. This must be done in order to have monitored traffic reach that VM.\n\nVMs that are \"being\" monitored, on the other hand, don\u0027t need to undergo any change in their boot process. \n\nSuitable APIs will be provided to add/remove ports belonging to the VMs one wants to monitor (source ports) to a TaaS instance, provided they belong to the same tenant.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":88,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 [1]_ to"},{"line_number":89,"context_line":"get the mirrored data out from the tenant virtual network on a device or"},{"line_number":90,"context_line":"network not managed by openstack."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The following would be the work flow for using this service from a tenants"},{"line_number":93,"context_line":"point of view"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_81cd2760","line":91,"updated":"2014-07-09 19:11:25.000000000","message":"Could it also be a service attachment point (SAP) when service base \u0026 insertion is merged?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":88,"context_line":"a VM on them, for example the port could be used as an \u0027external-port\u0027 [1]_ to"},{"line_number":89,"context_line":"get the mirrored data out from the tenant virtual network on a device or"},{"line_number":90,"context_line":"network not managed by openstack."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The following would be the work flow for using this service from a tenants"},{"line_number":93,"context_line":"point of view"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6d584f8a","line":91,"in_reply_to":"baada198_81cd2760","updated":"2014-07-15 13:02:50.000000000","message":"Yes... that is the plan, please refer to the \u0027Follow up work\u0027 section, we have addressed it there.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ff38514ec2f0a94ea39bea20a2290b695aae2bb9","unresolved":false,"context_lines":[{"line_number":105,"context_line":"------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"As an alternative to introducing port mirroring functionality under neutron"},{"line_number":108,"context_line":"services, it could be added as an extension to the existing neutron v2 APIs."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_2fe1afd0","line":108,"updated":"2014-07-16 16:42:09.000000000","message":"I actually like this approach more, it\u0027s less invasive and I think clearer to understand","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"8d91556790ce4136abc554faca4e53e0b64221f6","unresolved":false,"context_lines":[{"line_number":105,"context_line":"------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"As an alternative to introducing port mirroring functionality under neutron"},{"line_number":108,"context_line":"services, it could be added as an extension to the existing neutron v2 APIs."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_63665bf0","line":108,"in_reply_to":"baada198_2fe1afd0","updated":"2014-07-16 19:44:16.000000000","message":"While it may be possible to expose port-mirroring itself as an extension of the current Neutron APIs, we anticipate additional capabilities being added to TaaS in the future. Therefore, we propose going with the service route right from the beginning.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":138,"context_line":"|             |        |          |           | port          | service for destination |"},{"line_number":139,"context_line":"|             |        |          |           |               | of mirrored traffic     |"},{"line_number":140,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"2. Tap_Flow"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_41edcf8a","line":141,"updated":"2014-07-09 19:11:25.000000000","message":"Does the API create the port? If so, doesn\u0027t it need a network id?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":138,"context_line":"|             |        |          |           | port          | service for destination |"},{"line_number":139,"context_line":"|             |        |          |           |               | of mirrored traffic     |"},{"line_number":140,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"2. Tap_Flow"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_6de68fb1","line":141,"in_reply_to":"baada198_41edcf8a","updated":"2014-07-15 13:02:50.000000000","message":"My mistake... i have overlooked adding it in the table. But \u0027network_id\u0027 is part of the data model. Please check the \u0027RESOURCE_ATTRIBUTE_MAP\u0027,  \u0027network_id\u0027 is part of the the \u0027Tap_Service\u0027.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":166,"context_line":"|                | OUT,   |          |           |               | arriving at the         |"},{"line_number":167,"context_line":"|                | BOTH)  |          |           |               | source port             |"},{"line_number":168,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"REST API impact"},{"line_number":172,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_21129b62","line":169,"updated":"2014-07-09 19:11:25.000000000","message":"If we allow tap action in Group policy, you may want to tap traffic going to certain specific destination ports, though there is no harm in tap\u0027ing all the traffic.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"9f430f499ab4c249f743784ad7fdff3f8ed08f89","unresolved":false,"context_lines":[{"line_number":231,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":232,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":233,"context_line":"usually is destined to a VM that is not the same as the VM attached on"},{"line_number":234,"context_line":"the port that belongs to TaaS (mirror destination port)."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Traffic entering a source VM already goes through its inbound security group"},{"line_number":237,"context_line":"filters. On the other hand, traffic exiting a VM is yet to pass though its"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a9981376","line":234,"updated":"2014-06-25 15:31:28.000000000","message":"Can you clarify what does the last sentense mean ? It seems to me that \"the port that belongs to Taas\" \u003c\u003d\u003d\u003e the mirrored ports, not mirror destination port.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"51e8a07633f68d0c47d1211c1d8452cb06bd474d","unresolved":false,"context_lines":[{"line_number":231,"context_line":"The port(s) on which the TaaS runs should be able to forward mirrored packets"},{"line_number":232,"context_line":"to the VM attached to it without filtering it out. The mirrored traffic"},{"line_number":233,"context_line":"usually is destined to a VM that is not the same as the VM attached on"},{"line_number":234,"context_line":"the port that belongs to TaaS (mirror destination port)."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Traffic entering a source VM already goes through its inbound security group"},{"line_number":237,"context_line":"filters. On the other hand, traffic exiting a VM is yet to pass though its"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_03080027","line":234,"in_reply_to":"1ae5cdf2_a9981376","updated":"2014-06-25 17:34:40.000000000","message":"Here is an explanation.\n\nAs part of a TasS instance creation, we will instantiate a port that will serve as the destination end of a port-mirror session. A monitoring VM will be attached to this port so that it can receive mirrored traffic.\n\nLater, ports belonging to VMs that one is interested in monitoring will be added to the TasS instances. These ports will represent the source side of port-mirror sessions.\n\nThe last sentence is trying to say that the monitoring VM (attached to the destination side of the port-mirror session) is not the same the VMs (being monitored), whose ports are representing the source side of the port-mirror session.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"9f430f499ab4c249f743784ad7fdff3f8ed08f89","unresolved":false,"context_lines":[{"line_number":239,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":240,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":241,"context_line":"application of outbound filters."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":244,"context_line":"being mirrored, then the port security on that port also needs to be disabled"},{"line_number":245,"context_line":"along with the security group filters for that port."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c910ffad","line":242,"updated":"2014-06-25 15:31:28.000000000","message":"I will like to get comment from other reviewers on this statement.  My understanding will be the other way around. When tapping to network traffic, I will think we want to get the traffic passing in some specific network interfaces. It should be before VM inbound filters and after VM outbound filters, that is, the actual traffic running in the network.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"02a84bbd654afeb98d7bc95e7786d6fdaedb3867","unresolved":false,"context_lines":[{"line_number":239,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":240,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":241,"context_line":"application of outbound filters."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":244,"context_line":"being mirrored, then the port security on that port also needs to be disabled"},{"line_number":245,"context_line":"along with the security group filters for that port."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8ba09da6","line":242,"in_reply_to":"1ae5cdf2_c380d84b","updated":"2014-06-25 21:46:18.000000000","message":"Correction:\n\n\"...We are looking at things from the VM\u0027s point-of-view. We are attempting to debug Neutron networking and/or Security Group filter operation...\"\n\nshould read\n\n\"...We are looking at things from the VM\u0027s point-of-view. We are \u0027not\u0027 attempting to debug Neutron networking and/or Security Group filter operation...\"","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"51e8a07633f68d0c47d1211c1d8452cb06bd474d","unresolved":false,"context_lines":[{"line_number":239,"context_line":"(ideally and when possible) be placed at a logical spot that will allow"},{"line_number":240,"context_line":"packets to be mirrored after the application of inbound filters but before the"},{"line_number":241,"context_line":"application of outbound filters."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":244,"context_line":"being mirrored, then the port security on that port also needs to be disabled"},{"line_number":245,"context_line":"along with the security group filters for that port."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c380d84b","line":242,"in_reply_to":"1ae5cdf2_c910ffad","updated":"2014-06-25 17:34:40.000000000","message":"Hi Bao,\n\nPlease see my response to your first comment here. In essence, we are attempting to (potentially all) monitor traffic entering (egress) or leaving (egress) one or more VMs. \n\nSince Security Filters are applied before traffic really gets to a VM or after it actually leaves a VM, we would like to place the Tap location after inbound Security Filters and before output Security Filters.\n\nWe are looking at things from the VM\u0027s point-of-view. We are attempting to debug Neutron networking and/or Security Group filter operation.\n\nWe would like a tenant to be able to gain visibility into the actual network traffic entering or leaving one or more of their VMs.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":243,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":244,"context_line":"being mirrored, then the port security on that port also needs to be disabled"},{"line_number":245,"context_line":"along with the security group filters for that port."},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"On the destination side of the port mirror session, the receiving VM should be"},{"line_number":248,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_3cb560cd","line":246,"updated":"2014-07-09 19:11:25.000000000","message":"Are you saying port security on the source port should be disabled? Is the reason being to disable outbound filters?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":243,"context_line":"In case the port security extension is used and applied on the port that is"},{"line_number":244,"context_line":"being mirrored, then the port security on that port also needs to be disabled"},{"line_number":245,"context_line":"along with the security group filters for that port."},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"On the destination side of the port mirror session, the receiving VM should be"},{"line_number":248,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_8db76384","line":246,"in_reply_to":"baada198_3cb560cd","updated":"2014-07-15 13:02:50.000000000","message":"Yes... but for the first version of the TaaS, we would like to mirror (tap) the traffic as seen on the port.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":7278,"name":"Subrahmanyam Ongole","email":"songole@oneconvergence.com","username":"osms69"},"change_message_id":"7111eb2546931af923b7b4abf1d8937ace6f8c6b","unresolved":false,"context_lines":[{"line_number":248,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":250,"context_line":"outbound filters should apply as normal."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":253,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":254,"context_line":"traffic from any port(s) that belong to tenants. Hence creation of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_5c25b408","line":251,"updated":"2014-07-09 19:11:25.000000000","message":"Anti spoofing rules also need to be disabled on this port. Would the OVS agent execute this action depending on the type of port - needs port DB update? Therefore, explicit port security extension not needed? \n\nThere is also a problem with the bridge (between VM \u0026 OVS on dest host) learning, if we don\u0027t change destination MAC address of the original pkts.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"4933e009aecdb78e023801cd3e02cb2c856e6ce8","unresolved":false,"context_lines":[{"line_number":248,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":250,"context_line":"outbound filters should apply as normal."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":253,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":254,"context_line":"traffic from any port(s) that belong to tenants. Hence creation of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_786c8bd0","line":251,"in_reply_to":"baada198_5c25b408","updated":"2014-07-15 13:02:50.000000000","message":"Agreed, not mentioned here, but anti spoofing rules have to be disabled on this port.Yes the tap action will be executed by the OVS agent.\n\nThe issue of destination MAC address is being addressed in the reference implementation, and yes you will have to change the destination MAC Address to address the issue.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":6932,"name":"Adrian Hoban","email":"adrian.hoban@intel.com","username":"adrian-hoban"},"change_message_id":"f60ef6df1f0df60c1bbad9de5f1ad18726df67ce","unresolved":false,"context_lines":[{"line_number":248,"context_line":"allowed to see all of the mirrored traffic, hence, the mirrored traffic"},{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":250,"context_line":"outbound filters should apply as normal."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":253,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":254,"context_line":"traffic from any port(s) that belong to tenants. Hence creation of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa98f980_75e1db99","line":251,"in_reply_to":"baada198_786c8bd0","updated":"2014-09-08 16:53:40.000000000","message":"It would be nice to see an exception (or at least an open) captured in this section on how to address security groups when the tenant requires mirroring SR-IOV direct assigned (VNIC_DIRECT) ports.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":162,"name":"Bob Melander","email":"bob.melander@gmail.com","username":"bob-melander"},"change_message_id":"1be688becb4aedf072ddc79b3d8bf1ed42f2f627","unresolved":false,"context_lines":[{"line_number":249,"context_line":"should not pass through the inbound security group filters, however the"},{"line_number":250,"context_line":"outbound filters should apply as normal."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":253,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":254,"context_line":"traffic from any port(s) that belong to tenants. Hence creation of"},{"line_number":255,"context_line":"\u0027Tap_Flow\u0027(s) is only allowed on ports that are owned by the creating tenant."}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_fe85bfad","line":252,"updated":"2014-11-10 11:44:43.000000000","message":"So as has already been brought up the tap service depends on circumventing security groups. I\u0027d prefer if you would describe in detail how this is to be done. There is at least one BP on disabling security groups on certain networks or ports. I guess that could be one approach. In that case you should make that BP a dependency of this BP. And in any case it\u0027d be good to refer to it.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":162,"name":"Bob Melander","email":"bob.melander@gmail.com","username":"bob-melander"},"change_message_id":"1be688becb4aedf072ddc79b3d8bf1ed42f2f627","unresolved":false,"context_lines":[{"line_number":252,"context_line":"Keeping in mind the data privacy aspects and avoiding the data center admin"},{"line_number":253,"context_line":"from snooping on tenant traffic, the admin shall not be allowed to mirror"},{"line_number":254,"context_line":"traffic from any port(s) that belong to tenants. Hence creation of"},{"line_number":255,"context_line":"\u0027Tap_Flow\u0027(s) is only allowed on ports that are owned by the creating tenant."},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Notifications impact"},{"line_number":258,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_fed77fbd","line":255,"updated":"2014-11-10 11:44:43.000000000","message":"Disallowing admins to tap into any ports, regardless of owning tenant, seems to me to contradict the typical policy in neutron where an admin is not subject to tenant \"boundaries\". Isn\u0027t the admin considered a trusted party?","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":8895,"name":"Stanislav Kudriashev","email":"stas.kudriashev@gmail.com","username":"skudriashev"},"change_message_id":"4a13f7bc9956b26f26e7dd15db77159a4a60bece","unresolved":false,"context_lines":[{"line_number":262,"context_line":"---------------------"},{"line_number":263,"context_line":"None"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"Performance Impact"},{"line_number":266,"context_line":"------------------"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"The performance impact of mirroring traffic needs to be examined and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_5b568c2b","line":265,"updated":"2014-07-23 10:55:57.000000000","message":"Impact -\u003e impact","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":8279,"name":"Fawad Khaliq","email":"fawadkq@gmail.com","username":"fawadkhaliq"},"change_message_id":"5a0043e157fd2e6ee2eec188b3f02c948c0d4af9","unresolved":false,"context_lines":[{"line_number":274,"context_line":"  1. Rate limiting on the ports being mirrored."},{"line_number":275,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be mirror."},{"line_number":276,"context_line":"  3. Having a quota on the number of TaaS Flows that can be defined by the"},{"line_number":277,"context_line":"     tenant."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Other deployer impact"},{"line_number":280,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_cfdd2f16","line":277,"updated":"2014-07-18 18:12:52.000000000","message":"or make it an operator tool.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":8895,"name":"Stanislav Kudriashev","email":"stas.kudriashev@gmail.com","username":"skudriashev"},"change_message_id":"4a13f7bc9956b26f26e7dd15db77159a4a60bece","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Other deployer impact"},{"line_number":280,"context_line":"---------------------"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"None"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_bb32480d","line":281,"updated":"2014-07-23 10:55:57.000000000","message":"Redundant new line.","commit_id":"9d75351dbed821c3aabdcbda6a44a1775df55e92"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Tap-as-a-Service for Neutron"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This neutron spec is an extension of the port mirroring blueprint. while the"},{"line_number":12,"context_line":"blueprint proposes the functionality of mirroring neutron ports as an extension"},{"line_number":13,"context_line":"to the port object, the spec proposes to offer port mirroring as a service"},{"line_number":14,"context_line":"which enables more advance usecases (ex. intrution detection) to be deployed"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_bd067dcc","line":11,"updated":"2014-12-10 14:57:47.000000000","message":"while -\u003e While","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"This neutron spec is an extension of the port mirroring blueprint. while the"},{"line_number":12,"context_line":"blueprint proposes the functionality of mirroring neutron ports as an extension"},{"line_number":13,"context_line":"to the port object, the spec proposes to offer port mirroring as a service"},{"line_number":14,"context_line":"which enables more advance usecases (ex. intrution detection) to be deployed"},{"line_number":15,"context_line":"using the service."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The above mentioned blueprint aims to add port mirroring capabilities in"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_9dff01aa","line":14,"updated":"2014-12-10 14:57:47.000000000","message":"intrusion","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":102,"context_line":"     destination port for the tap service instance."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  3. Associat Neutron ports with a tap service instance if/when they need to be"},{"line_number":105,"context_line":"     monitored."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_7d7895f2","line":104,"updated":"2014-12-10 14:57:47.000000000","message":"Associate","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":111,"context_line":"     remove the Neutron port that was serving as the destination port for"},{"line_number":112,"context_line":"     the tap service."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Please not that the normal work flow of launching a VM is not effected while using"},{"line_number":115,"context_line":"TaaS."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_1dd6b1c5","line":114,"updated":"2014-12-10 14:57:47.000000000","message":"note","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":189,"context_line":"REST API impact"},{"line_number":190,"context_line":"---------------"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"The Tap-as-a-Serivice shall be offered over the RESTFull API interface under"},{"line_number":193,"context_line":"the following namespace:"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"http://wiki.openstack.org/Neutron/TaaS/API_1.0"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_3d036d43","line":192,"updated":"2014-12-10 14:57:47.000000000","message":"Serivice -\u003e Service","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":265,"context_line":""},{"line_number":266,"context_line":"Notifications impact"},{"line_number":267,"context_line":"--------------------"},{"line_number":268,"context_line":"None"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"IPv6 impact"},{"line_number":271,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_da998f20","line":268,"updated":"2014-12-10 14:57:47.000000000","message":"Don\u0027t you need new RPC calls?","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":272,"context_line":"None"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Other end user impact"},{"line_number":275,"context_line":"---------------------"},{"line_number":276,"context_line":"None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_3a8a93bf","line":275,"updated":"2014-12-10 14:57:47.000000000","message":"If you are going to allow python-neutronclient to invoke the APIs, then you should mention it here.","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"ea0a612c9bd989173dd15ebfb5d7909dcb7a5d8d","unresolved":false,"context_lines":[{"line_number":292,"context_line":""},{"line_number":293,"context_line":"Other deployer impact"},{"line_number":294,"context_line":"---------------------"},{"line_number":295,"context_line":"None"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"Developer impact"},{"line_number":298,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_7aab3b1d","line":295,"updated":"2014-12-10 14:57:47.000000000","message":"You have to add the details to configure the service plugin as you are planning to implement this as a service","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":6932,"name":"Adrian Hoban","email":"adrian.hoban@intel.com","username":"adrian-hoban"},"change_message_id":"c6e339c84b12b46079197a615f361161c8b8804c","unresolved":false,"context_lines":[{"line_number":324,"context_line":"priority flow that forwards the packet to both \u0027br-tap\u0027 and to the normal"},{"line_number":325,"context_line":"processing. Similarly, ingress packets will be mirrored from \u0027br-tun\u0027 to"},{"line_number":326,"context_line":"\u0027br-tap\u0027 by adding a higher priority flow that forwards the packet to both"},{"line_number":327,"context_line":"\u0027br-int\u0027 and \u0027br-tap\u0027."},{"line_number":328,"context_line":""},{"line_number":329,"context_line":"Internally the Tap service will use VLAN tags to identify the tap instances."},{"line_number":330,"context_line":"In the initial release these tags will be reserved from highest to lower; in"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_f4f2e16d","line":327,"updated":"2014-12-11 02:09:07.000000000","message":"Around line 20 you state that: \"mirrored ingress packets are captured after passing the inbound Security Group filter. Mirrored egress packets are captured before passing the outbound Security Group Filter\".\n\nSecurity groups are associated with the tap device above br-int so I\u0027m not sure that this implementation meets with your stated security group needs. \n\nHowever, the proposed implementation seems practical to me, so suggest a minor update around line 20 to clarify the goals with respect to the security groups.","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":162,"name":"Bob Melander","email":"bob.melander@gmail.com","username":"bob-melander"},"change_message_id":"756be53c552aa6208e97a7eb71446856108f8001","unresolved":false,"context_lines":[{"line_number":325,"context_line":"processing. Similarly, ingress packets will be mirrored from \u0027br-tun\u0027 to"},{"line_number":326,"context_line":"\u0027br-tap\u0027 by adding a higher priority flow that forwards the packet to both"},{"line_number":327,"context_line":"\u0027br-int\u0027 and \u0027br-tap\u0027."},{"line_number":328,"context_line":""},{"line_number":329,"context_line":"Internally the Tap service will use VLAN tags to identify the tap instances."},{"line_number":330,"context_line":"In the initial release these tags will be reserved from highest to lower; in"},{"line_number":331,"context_line":"later release it should be coordinated with the Neutron service."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_d6cf6d54","line":328,"updated":"2014-12-11 23:03:06.000000000","message":"Is there any risk of packets \"leaking\" across networks part of the same tap? If so, how do you prevent that?","commit_id":"e99285d240c338632b12cfdcf106d1845ca3a7bf"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This Neutron spec is an extension of the port mirroring blueprint. Port"},{"line_number":12,"context_line":"mirroring involves sending a copy of packets ingressing and/or egressing one"},{"line_number":13,"context_line":"port (where ingress means entering a VM and egress means leaving a VM) to"},{"line_number":14,"context_line":"another port, (usually different from the packet’s original destination)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"While the blueprint describes the functionality of mirroring Neutron ports as"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_12b38898","line":13,"updated":"2014-12-14 22:11:42.000000000","message":"I think you follow the direction definition used by security group, but I don\u0027t think it is not easy to understand. In the traditional network context, the port mirroring is a function specific to a network switch, but security group feature is specific to a VM.\nConsidering this background, I think it looks natural that \"ingress\" means traffic from a VM into a network. I believe it is easier for network operators to understand the feature. Thought?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"2c1c28f9cceb1ae9d59a9fc592936b52f2afb4fb","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This Neutron spec is an extension of the port mirroring blueprint. Port"},{"line_number":12,"context_line":"mirroring involves sending a copy of packets ingressing and/or egressing one"},{"line_number":13,"context_line":"port (where ingress means entering a VM and egress means leaving a VM) to"},{"line_number":14,"context_line":"another port, (usually different from the packet’s original destination)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"While the blueprint describes the functionality of mirroring Neutron ports as"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_330243b4","line":13,"in_reply_to":"3a961159_12b38898","updated":"2014-12-15 06:55:35.000000000","message":"Depending on whom one asks, I think this thing can go either way. We don’t really have a preference. For the purpose of this spec, we felt it important to define ingress and egress in one way and stick with it throughout. The fact that we are lined up with the definitions used by Security Groups is a plug I think because this makes the discussion of tap point placement and the inbound and output Security Group filters less confusing.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This Neutron spec is an extension of the port mirroring blueprint. Port"},{"line_number":12,"context_line":"mirroring involves sending a copy of packets ingressing and/or egressing one"},{"line_number":13,"context_line":"port (where ingress means entering a VM and egress means leaving a VM) to"},{"line_number":14,"context_line":"another port, (usually different from the packet’s original destination)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"While the blueprint describes the functionality of mirroring Neutron ports as"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ba2a4a7c","line":13,"in_reply_to":"3a961159_330243b4","updated":"2014-12-16 18:01:39.000000000","message":"I agree with Akihiro here, we should change this so it\u0027s focused from the switch perspective.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":13263,"name":"Zoltán Lajos Kis","email":"zoltan.lajos.kis@ericsson.com","username":"ZoltanLajosKis"},"change_message_id":"28eea7faafdc1e47eff6483eb1543f59e6cc7023","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This Neutron spec is an extension of the port mirroring blueprint. Port"},{"line_number":12,"context_line":"mirroring involves sending a copy of packets ingressing and/or egressing one"},{"line_number":13,"context_line":"port (where ingress means entering a VM and egress means leaving a VM) to"},{"line_number":14,"context_line":"another port, (usually different from the packet’s original destination)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"While the blueprint describes the functionality of mirroring Neutron ports as"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ed16de54","line":13,"in_reply_to":"3a961159_ba2a4a7c","updated":"2014-12-16 18:59:30.000000000","message":"I think the vNIC / Neutron port is a good choice because it is a well defined reference point in the API and across implementations.\n\nI agree that it would also be useful to monitor traffic on switch ports; or in fact at arbitrary points of the architecture. But do we have a clear definition of any other reference point that is agnostic to implementations and is well understood by a wide audience?\n\nWhen speaking of \"from the switch perspective\", do we mean to include the routing decision in case of DVR or ODL, and do we mean to include security groups if they happen to be implemented by OVS?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"This Neutron spec is an extension of the port mirroring blueprint. Port"},{"line_number":12,"context_line":"mirroring involves sending a copy of packets ingressing and/or egressing one"},{"line_number":13,"context_line":"port (where ingress means entering a VM and egress means leaving a VM) to"},{"line_number":14,"context_line":"another port, (usually different from the packet’s original destination)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"While the blueprint describes the functionality of mirroring Neutron ports as"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_7646e0c1","line":13,"in_reply_to":"3a961159_ed16de54","updated":"2014-12-19 00:06:18.000000000","message":"1 point to resolve\n\nI second Kyle\u0027s and Akihiro\u0027s sentiment. I think the focus of egress/ingress should be defined from the point of view of the service that provides the port mirroring. I understand that this goes the opposite way of security groups\u0027. But there the point of view is the VM\u0027s","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"to be deployed."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":22,"context_line":"service called ‘Tap-as-a-Service."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ba516a10","line":22,"updated":"2014-12-16 18:01:39.000000000","message":"I\u0027m still not sold on the fact we want TapaaS inside of Neutron itself.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":19,"context_line":"to be deployed."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":22,"context_line":"service called ‘Tap-as-a-Service."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b613e8b6","line":22,"in_reply_to":"3a961159_ba516a10","updated":"2014-12-19 00:06:18.000000000","message":"2 points to resolve\n\nI would like to see this innovate and experiment on the side, rather than bolted on Neutron itself. I think there\u0027s this spec sets the premise for this, proposing a fully fledged service interface.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":22,"context_line":"service called ‘Tap-as-a-Service."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b4b28f91","line":23,"updated":"2014-12-15 14:54:10.000000000","message":"nit: quote","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":22,"context_line":"service called ‘Tap-as-a-Service."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6a7be27a","line":23,"in_reply_to":"3a961159_b4b28f91","updated":"2014-12-18 18:32:50.000000000","message":"Will edit","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"911574702b2d1d3bc2f99358674485e4b86b2157","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The proposed port mirroring capability shall be introduced in Neutron as a"},{"line_number":22,"context_line":"service called ‘Tap-as-a-Service."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5dd3f25e","line":23,"in_reply_to":"3a961159_b4b28f91","updated":"2014-12-17 22:04:14.000000000","message":"Will fix.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Neutron currently does not support the functionality of port mirroring for"},{"line_number":28,"context_line":"tenant networks. This feature will greatly benefit tenants who want to debug"},{"line_number":29,"context_line":"their virtual networks and gain visibility into their VMs by monitoring and"},{"line_number":30,"context_line":"analyzing the network traffic associated with them (e.g. IDS)."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This Neutron spec focusses on mirroring traffic from one Neutron port to"},{"line_number":33,"context_line":"another; future versions may address mirroring from a Neutron port to an"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_9a73ceb3","line":30,"updated":"2014-12-16 18:01:39.000000000","message":"I\u0027m not sure how most operators would feel about the above statement. From an NFV perspective, this may be the case. I\u0027d be curious to understand how non-NFV operators feel.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10318,"name":"Alan Kavanagh","email":"alan.kavanagh@ericsson.com","username":"lmcakav26"},"change_message_id":"8b80df4ab54b0a3a83e0117a4fc5a1ad8d94d13c","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Neutron currently does not support the functionality of port mirroring for"},{"line_number":28,"context_line":"tenant networks. This feature will greatly benefit tenants who want to debug"},{"line_number":29,"context_line":"their virtual networks and gain visibility into their VMs by monitoring and"},{"line_number":30,"context_line":"analyzing the network traffic associated with them (e.g. IDS)."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This Neutron spec focusses on mirroring traffic from one Neutron port to"},{"line_number":33,"context_line":"another; future versions may address mirroring from a Neutron port to an"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6db9f5ca","line":30,"in_reply_to":"3a961159_9a73ceb3","updated":"2014-12-17 19:04:41.000000000","message":"From an NFV perspective as we deploy VNF\u0027s and using Neutron Networks we need a way to trouble shoot the networks before these nodes are brought into service and during service. Port mirroring is one tool we use for such a case.\nIn the non NFV case, lets say for 3-tier web services port mirroring is something we also use when we deploy this for example behind the Gateway nodes in Mobile and fixed networks in the event we see strange packet behavior and use port mirroring as a simple way to sanity check the config and config of the network....same will apply for doing this through a neutron network.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Proposed change"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"The proposal is to introduce a new Neutron service, called ‘Tap-as-a-Service’,"},{"line_number":47,"context_line":"which provides tapping (port-mirroring) capability for tenant networks. This"},{"line_number":48,"context_line":"service will be modeled similar to other Neutron services such as the firewall,"},{"line_number":49,"context_line":"load-balancer, L3-router etc."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_0da24a9a","line":46,"updated":"2014-12-16 19:33:49.000000000","message":"technically neutron is already a service.\nDo you mean \"new openstack networking service\" or \"new neutron service plugin\"?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Proposed change"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"The proposal is to introduce a new Neutron service, called ‘Tap-as-a-Service’,"},{"line_number":47,"context_line":"which provides tapping (port-mirroring) capability for tenant networks. This"},{"line_number":48,"context_line":"service will be modeled similar to other Neutron services such as the firewall,"},{"line_number":49,"context_line":"load-balancer, L3-router etc."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_dd3a6997","line":46,"in_reply_to":"3a961159_0da24a9a","updated":"2014-12-18 18:32:50.000000000","message":"it would be a new neutron service plugin","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"The proposal is to introduce a new Neutron service, called ‘Tap-as-a-Service’,"},{"line_number":47,"context_line":"which provides tapping (port-mirroring) capability for tenant networks. This"},{"line_number":48,"context_line":"service will be modeled similar to other Neutron services such as the firewall,"},{"line_number":49,"context_line":"load-balancer, L3-router etc."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The proposed service will allow the tenants to create a tap service instance"},{"line_number":52,"context_line":"to which they can add Neutron ports that need to be mirrored by creating tap"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_7a5e2214","line":49,"updated":"2014-12-16 18:01:39.000000000","message":"The referenced services (outside of L3-router) are all no longer in core Neutron. Further, we don\u0027t have a precedent yet for adding a new service such as this using the new framework.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":46,"context_line":"The proposal is to introduce a new Neutron service, called ‘Tap-as-a-Service’,"},{"line_number":47,"context_line":"which provides tapping (port-mirroring) capability for tenant networks. This"},{"line_number":48,"context_line":"service will be modeled similar to other Neutron services such as the firewall,"},{"line_number":49,"context_line":"load-balancer, L3-router etc."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The proposed service will allow the tenants to create a tap service instance"},{"line_number":52,"context_line":"to which they can add Neutron ports that need to be mirrored by creating tap"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f6ce502c","line":49,"in_reply_to":"3a961159_2dc6264a","updated":"2014-12-19 00:06:18.000000000","message":"3 points to resolve.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":46,"context_line":"The proposal is to introduce a new Neutron service, called ‘Tap-as-a-Service’,"},{"line_number":47,"context_line":"which provides tapping (port-mirroring) capability for tenant networks. This"},{"line_number":48,"context_line":"service will be modeled similar to other Neutron services such as the firewall,"},{"line_number":49,"context_line":"load-balancer, L3-router etc."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The proposed service will allow the tenants to create a tap service instance"},{"line_number":52,"context_line":"to which they can add Neutron ports that need to be mirrored by creating tap"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2dc6264a","line":49,"in_reply_to":"3a961159_7a5e2214","updated":"2014-12-16 19:33:49.000000000","message":"The author of the spec is not making things easier by putting L3-router (service plugin but part of core operations) and lbaas (service plugin which has been spun-off), on the same layer.\n\nIt would be good to clarify the intention - that is to say: should this service plugin be part of a neutron \"core\" deployment, or can it be leverage as an optional component in a neutron deployment?\n\nTo me it seems tapping ports falls more into the latter category.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The proposed service will allow the tenants to create a tap service instance"},{"line_number":52,"context_line":"to which they can add Neutron ports that need to be mirrored by creating tap"},{"line_number":53,"context_line":"flows. The tap service itself will be a Neutron port, which will be the"},{"line_number":54,"context_line":"destination port for the mirrored traffic."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"The destination Tap-as-a-Service Neutron port will be created on a network"},{"line_number":57,"context_line":"owned by the tenant who is requesting the service. The ports to be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ad085692","line":54,"updated":"2014-12-16 19:33:49.000000000","message":"this will require guards in place to ensure this port is not then used for other purposes, but I would defer this kind of detail to the implementation part.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10318,"name":"Alan Kavanagh","email":"alan.kavanagh@ericsson.com","username":"lmcakav26"},"change_message_id":"8b80df4ab54b0a3a83e0117a4fc5a1ad8d94d13c","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The proposed service will allow the tenants to create a tap service instance"},{"line_number":52,"context_line":"to which they can add Neutron ports that need to be mirrored by creating tap"},{"line_number":53,"context_line":"flows. The tap service itself will be a Neutron port, which will be the"},{"line_number":54,"context_line":"destination port for the mirrored traffic."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"The destination Tap-as-a-Service Neutron port will be created on a network"},{"line_number":57,"context_line":"owned by the tenant who is requesting the service. The ports to be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ed2085fa","line":54,"in_reply_to":"3a961159_ad085692","updated":"2014-12-17 19:04:41.000000000","message":"Agree makes sense.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b29b9416","line":66,"updated":"2014-12-14 22:11:42.000000000","message":"The above two paragraph is important from access control perspective. Could you describe the condition what port can be monitored and who can monitor which ports more systematic way? It brings us more clear understanding. It is ambiguous to describe this kind of things by sentences to me.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3434dffa","line":66,"in_reply_to":"3a961159_24803b8a","updated":"2014-12-15 14:54:10.000000000","message":"And, presumably: a tenant must create the port to mirror to.\n\nPerhaps, since this is not completely clear from your wording, you could spell those two points out as bullets?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3aabbad7","line":66,"in_reply_to":"3a961159_3434dffa","updated":"2014-12-16 18:01:39.000000000","message":"+1 to the comments from Ian.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_aac6aa97","line":66,"in_reply_to":"3a961159_3434dffa","updated":"2014-12-18 18:32:50.000000000","message":"Creation of the Tap Service instance creates the port to mirror to, and since the Tap Service will belong to the tenant, so will the port created as a result of it.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_0d6c0a36","line":66,"in_reply_to":"3a961159_3aabbad7","updated":"2014-12-16 19:33:49.000000000","message":"Looking at REST spec, the intention of the author is to create the destination port as a part of the TAP service creation. I agree however that supplying an explicit port_id is a perfectly viable workflow as well, and it should be supported, also because that\u0027s what we already do with routers, an an example","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b6ef6886","line":66,"in_reply_to":"3a961159_aac6aa97","updated":"2014-12-19 00:06:18.000000000","message":"4 points to resolve","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"5387f93f50f0cbb805b7712cd65243da0465cdf3","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The ports owned by the tenant that are mirrored can be on networks other"},{"line_number":64,"context_line":"than the network on which tap service port is created. This allows the tenant"},{"line_number":65,"context_line":"to mirror traffic from any port it owns on a network on to the same"},{"line_number":66,"context_line":"Tap-as-a-Serivce Neutron port."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_24803b8a","line":66,"in_reply_to":"3a961159_b29b9416","updated":"2014-12-15 09:41:02.000000000","message":"The summary of the the two paragraphs is as follows:\n\n* A tenant can only mirror ports that it owns.\n\nThis aspect has been discussed in previous patch set and in the neutron advance service group meeting previously, please refer the discussion on this in previous patch sets.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"},{"line_number":70,"context_line":"VM interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2702f309","line":71,"updated":"2014-12-15 14:54:10.000000000","message":"This is bizarre.  Why don\u0027t you attach your tap service to a network, forward traffic to that network and attach snooper VMs to that same network?\n\nYou\u0027re proposing creating a bizarre new port type, which apparently has no relationship to the network it\u0027s on since it only receives traffic from the TAP service it\u0027s associated with.\n\nYou also don\u0027t make it clear what happens to traffic sent to that port (presumably it\u0027s discarded).","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"},{"line_number":70,"context_line":"VM interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_9ae82e18","line":71,"in_reply_to":"3a961159_2702f309","updated":"2014-12-16 18:01:39.000000000","message":"Not only is this bizarre, but the fact we\u0027re tieing the backend implementation here (e.g. you launch a VM) doesn\u0027t sound right.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"},{"line_number":70,"context_line":"VM interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d06d35ce","line":71,"in_reply_to":"3a961159_9ae82e18","updated":"2014-12-16 19:33:49.000000000","message":"honestly to me it seems simply that the author is stating that if you create a VM attached to a tap destination port that VM will receive mirrored traffic. This is not really bizarre - the port is just a standard port on a standard network.\n\nThe VM being launched here also is not part of the TAP service itself, it\u0027s just where a tenant will have the software to analyze mirrored traffic.\n\nSo at least on this count I disagree with the concerns expressed.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":68,"context_line":"In the first version of this service, the tenant can launch a VM specifying"},{"line_number":69,"context_line":"the tap port id (resulting from the creation of tap service instance) for the"},{"line_number":70,"context_line":"VM interface (--nic port-id\u003dtap_port_uuid), thus receiving mirrored traffic for"},{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_96dfccd5","line":71,"in_reply_to":"3a961159_d06d35ce","updated":"2014-12-19 00:06:18.000000000","message":"5 points to resolve","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_705e4114","line":74,"updated":"2014-12-16 19:33:49.000000000","message":"While the concept expressed here might be valid, the referenced blueprint probably isn\u0027t (as stated elsewhere in comments)","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"further processing (dependent on use case) on that VM. In latter versions, the"},{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_da442476","line":74,"in_reply_to":"3a961159_705e4114","updated":"2014-12-18 18:32:50.000000000","message":"Will edit it in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"},{"line_number":78,"context_line":"point of view"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3ad9fa83","line":75,"updated":"2014-12-16 18:01:39.000000000","message":"So you\u0027re allowing tenants to send mirrored traffic out into an operators network? Yikes.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"},{"line_number":78,"context_line":"point of view"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b030a99f","line":75,"in_reply_to":"3a961159_3ad9fa83","updated":"2014-12-16 19:33:49.000000000","message":"It might sound yucky but I guess this is what some operator want to do (and probably already do)","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"},{"line_number":78,"context_line":"point of view"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f66ad0eb","line":75,"in_reply_to":"3a961159_6d66552b","updated":"2014-12-19 00:06:18.000000000","message":"I appreciate that from a tenant point of view, he/she cannot get the guarantee that private traffic doesn\u0027t get snooped, but making this explicit by design makes me a bit uneasy. I can see that this has been discussed before.\n\nDoes this mean that to ensure data and traffic privacy for a tenant we need to add a new network type, e.g. Tor, which cannot be hijacked? To me this sounds the only way to address the privacy concern. Adding complications to the workflow as suggested below doesn\u0027t seem to address the problem to the root, IMO\n\n6 points to resolve","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10318,"name":"Alan Kavanagh","email":"alan.kavanagh@ericsson.com","username":"lmcakav26"},"change_message_id":"8b80df4ab54b0a3a83e0117a4fc5a1ad8d94d13c","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Neutron port instantiated by the service can be used for purposes other than"},{"line_number":73,"context_line":"just launching a VM on it, for example the port could be used as an"},{"line_number":74,"context_line":"\u0027external-port\u0027 [1]_ to get the mirrored data out from the tenant virtual"},{"line_number":75,"context_line":"network on a device or network not managed by openstack."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"The following would be the work flow for using this service from a tenant\u0027s"},{"line_number":78,"context_line":"point of view"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6d66552b","line":75,"in_reply_to":"3a961159_b030a99f","updated":"2014-12-17 19:04:41.000000000","message":"NFV Operators would be required to support such a service in the event of regulatory issues like Lawful Intercept where the traffic is directed to an external network.....i.e. external entity.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":81,"context_line":"     port (the destination port for the tap service instance) will be returned"},{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3050395e","line":84,"updated":"2014-12-16 19:33:49.000000000","message":"a possible alternative would be to have \"snooper agents\" managed by the TAP service monitoring traffic. You could have a pluggable infrastructure to deploy the agent you wish, you could you use namespaces and containers.\n\nThe resulting architecture would be similar to that of the DHCP agent.\n\nCan you explain why that would not be viable in the alternative section?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d2e740aa","line":85,"updated":"2014-12-14 22:11:42.000000000","message":"This workflow is unclear to me. Do you mean you pass a port UUID returned by step 1 when launching a VM? Or do you mean associating a port which is created during launching a VM to a tap service instance?\n\nTo monitor traffic, \"the destination port\" at L.81 needs to be connected to a VM launched at L.84, but it is unclear how the destination port (L.81) is treated to me.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f0e151ff","line":85,"in_reply_to":"3a961159_c4adb79c","updated":"2014-12-16 19:33:49.000000000","message":"to me the whole point is that step 2 is actually not part of the TAP service workflow.\n\nThere is however an aspect the author should clarify:\n- if the TAP service owns the mirror dest port, it will likely set something like network:tap (I think you recall I hate *aas) as device_owner\n- as a part of the nova boot process, any device attached to a VM gets a compute:nova device_owner\n\nShould this workflow change for the tap service? If yes, you might need a change in nova too.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"5387f93f50f0cbb805b7712cd65243da0465cdf3","unresolved":false,"context_lines":[{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_c4adb79c","line":85,"in_reply_to":"3a961159_d2e740aa","updated":"2014-12-15 09:41:02.000000000","message":"You first create a tap service instance, which return with an UUID of the port created where the mirrored traffic will be sent (mirror destination). You then use this port UUID while launching a VM that is used to monitor the traffic.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f55ad128","line":85,"in_reply_to":"3a961159_f0e151ff","updated":"2014-12-18 18:32:50.000000000","message":"i need to dwell on this question a bit more, will come back with an answer soon.\n\nBut i guess the method of having the tenant supply the port (suggested by akihiro and salvatore) while creating the tap service would not have an issue.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":82,"context_line":"     (this port is created on the specified tenant network)."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  2. Launch a monitoring or traffic analysis VM and connect it to the"},{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_767ee0b0","line":85,"in_reply_to":"3a961159_f55ad128","updated":"2014-12-19 00:06:18.000000000","message":"7 points to resolve","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_072ed78b","line":88,"updated":"2014-12-15 14:54:10.000000000","message":"ports plural?  If you reflect multiple ports to the same destination, would you be able to discriminate the traffic?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ba3b2a9b","line":88,"in_reply_to":"3a961159_072ed78b","updated":"2014-12-16 18:01:39.000000000","message":"I have the same question.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6a5762ca","line":88,"in_reply_to":"3a961159_072ed78b","updated":"2014-12-18 18:32:50.000000000","message":"typo, it should be port.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"911574702b2d1d3bc2f99358674485e4b86b2157","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3d82a652","line":88,"in_reply_to":"3a961159_30caf96e","updated":"2014-12-17 22:04:14.000000000","message":"The packets delivered to the destination port of a tap service instance are unmodified. I.e. they are identical copies of the packets that were captured at the source ports. Applying (traditional) network filtering techniques will allow one to easily separate out the traffic associated with an individual source port if needed. In some cases, one may not be interested in identifying flows belonging to individual source ports, but might want to filter out specific types of traffic (e.g. http traffic) associated some or all of the source ports. Such operations can be carried out inside the monitoring VM that is attached to the destination port of a tap service instance or further downstream, if the monitoring VM is in turn forwarding the mirrored traffic to another destination. This is something that is best left to the discretion of the consumer of the tap service instance.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"13fb9f881f3646fedd8e959f16ad94436e273384","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_266351de","line":88,"in_reply_to":"3a961159_6a5762ca","updated":"2014-12-18 19:41:49.000000000","message":"Sorry ports are correct, please ignore my previous comment.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     destination port for the tap service instance."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_30caf96e","line":88,"in_reply_to":"3a961159_ba3b2a9b","updated":"2014-12-16 19:33:49.000000000","message":"I think they\u0027ll use SRC MAC? The author should clarify how\u0027s that handled","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"  5. Destroy a tap-service instance when it is no longer needed. This will"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_fa45b217","line":90,"updated":"2014-12-16 18:01:39.000000000","message":"Nit: s/then/they/","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"911574702b2d1d3bc2f99358674485e4b86b2157","unresolved":false,"context_lines":[{"line_number":87,"context_line":"  3. Associate Neutron ports with a tap service instance if/when they need to be"},{"line_number":88,"context_line":"     monitored."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  4. Disassociate Neutron ports from a tap service instance if/when then no"},{"line_number":91,"context_line":"     longer need to be monitored."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"  5. Destroy a tap-service instance when it is no longer needed. This will"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1db96a15","line":90,"in_reply_to":"3a961159_fa45b217","updated":"2014-12-17 22:04:14.000000000","message":"Will fix.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":94,"context_line":"     remove the Neutron port that was serving as the destination port for"},{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_279e73b9","line":97,"updated":"2014-12-15 14:54:10.000000000","message":"sp: \u0027affected\u0027","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"911574702b2d1d3bc2f99358674485e4b86b2157","unresolved":false,"context_lines":[{"line_number":94,"context_line":"     remove the Neutron port that was serving as the destination port for"},{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5d3a1299","line":97,"in_reply_to":"3a961159_279e73b9","updated":"2014-12-17 22:04:14.000000000","message":"Will fix.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":94,"context_line":"     remove the Neutron port that was serving as the destination port for"},{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ca6f7690","line":97,"in_reply_to":"3a961159_279e73b9","updated":"2014-12-18 18:32:50.000000000","message":"will correct it.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"},{"line_number":101,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_52fb5046","line":98,"updated":"2014-12-14 22:11:42.000000000","message":"Related to the above my comment, if you pass a port of Tap-as-a-Service instance to a VM, nova delete the port attached to the VM when the VM is deleted. we need to take care of this situation, so I don\u0027t think passing the destination port of TaaS instance to a monitor VM works.\n\nI think a destination port may need to be pluggable/associated to a TaaS service instance: for example\n- create a TaaS instance\n- launch a monitor VM\n- associate a port of the monitor VM to the TaaS instance *as a destination port*\n\nThought?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"},{"line_number":101,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d5d155ce","line":98,"in_reply_to":"3a961159_52fb5046","updated":"2014-12-18 18:32:50.000000000","message":"Point taken. As indicated in one of the previous comments, will allow the option of having the tenant pass the port to be used as a \u0027destination port\u0027 while creating the tap service instance.\n\nAbout the deletion, it needs to be handled in two of the below cases:\n\n1. Deletion of the VM (and port attched to it) from which we were mirroring (source of the mirror):\n\nIn this case we would do a cascade delete of the \u0027Tap_Flow\u0027 instances that were associated with the port that was deleted.\n\n2. Deletion of the VM (and port attched to it) to which we were mirroring (Destination of the mirror):\n\nIn this case we would do a cascade delete of the \u0027Tap_Service\u0027 instance that was associated with the port that was deleted.\n\nThe above description is missing from the spec, we will add it with sufficient detail in the next patch.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"     the tap service."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Please note that the normal work flow of launching a VM is not effected while using"},{"line_number":98,"context_line":"TaaS."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Alternatives"},{"line_number":101,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_677b1b7b","line":98,"in_reply_to":"3a961159_52fb5046","updated":"2014-12-15 14:54:10.000000000","message":"This appears to be another alternative, as mine is.  List as alternatives, call out why you\u0027ve chosen the one you\u0027ve chosen versus the alternatives.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":101,"context_line":"------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"As an alternative to introducing port mirroring functionality under Neutron"},{"line_number":104,"context_line":"services, it could be added as an extension to the existing Neutron v2 APIs."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_a7dfc367","line":104,"updated":"2014-12-15 14:54:10.000000000","message":"And that tells me precisely nothing about what the difference would be in terms of API experience.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"af1357608990b1161f373533c079f92c04253847","unresolved":false,"context_lines":[{"line_number":101,"context_line":"------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"As an alternative to introducing port mirroring functionality under Neutron"},{"line_number":104,"context_line":"services, it could be added as an extension to the existing Neutron v2 APIs."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d61eb46f","line":104,"in_reply_to":"3a961159_a7dfc367","updated":"2014-12-19 00:06:18.000000000","message":"The way I understand this would be that a port gets an extra attribute port-mirror, which is the port uuid of the mirrored port, how that would work in practice would be remain to be seen.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":137,"context_line":"| port_id     | UUID   + R, all   | N/A       | UUID of a     | A Neutron port          |"},{"line_number":138,"context_line":"|             |        |          |           | valid Neutron | is created by the       |"},{"line_number":139,"context_line":"|             |        |          |           | port          | service for destination |"},{"line_number":140,"context_line":"|             |        |          |           |               | of mirrored traffic     |"},{"line_number":141,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"2. Tap_Flow"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_67aa3b86","line":140,"updated":"2014-12-15 14:54:10.000000000","message":"Suggest you don\u0027t actually create a port (or, alternatively, the port is used to put traffic *onto* the network), per comments above.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":137,"context_line":"| port_id     | UUID   + R, all   | N/A       | UUID of a     | A Neutron port          |"},{"line_number":138,"context_line":"|             |        |          |           | valid Neutron | is created by the       |"},{"line_number":139,"context_line":"|             |        |          |           | port          | service for destination |"},{"line_number":140,"context_line":"|             |        |          |           |               | of mirrored traffic     |"},{"line_number":141,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"2. Tap_Flow"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_70a9e17a","line":140,"in_reply_to":"3a961159_67aa3b86","updated":"2014-12-16 19:33:49.000000000","message":"it seems to me that according to the author, one would create a tap service on some network, and on that network there will be created - by the tap service itself - a port. This port, like a garden hose, will spill all the traffic of the source ports attached to the tap service.\n\nI think an implementation where the user provides an explicit port_id should be allowed as well (and in that case network_id) should be ignored.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":137,"context_line":"| port_id     | UUID   + R, all   | N/A       | UUID of a     | A Neutron port          |"},{"line_number":138,"context_line":"|             |        |          |           | valid Neutron | is created by the       |"},{"line_number":139,"context_line":"|             |        |          |           | port          | service for destination |"},{"line_number":140,"context_line":"|             |        |          |           |               | of mirrored traffic     |"},{"line_number":141,"context_line":"+-------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"2. Tap_Flow"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b5ecc92a","line":140,"in_reply_to":"3a961159_70a9e17a","updated":"2014-12-18 18:32:50.000000000","message":"Salvatore, agreed, i guess its better to have an option where the tenant can explicitly provide the port_id, having both options (creation of  the port by the service and using a port provided)  is better.\n\nI will take in the suggestion and make the needed change in the data model and REST API  in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":159,"context_line":"|                |        |          |           | service UUID  | service instance.       |"},{"line_number":160,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":161,"context_line":"| source_port    | UUID   | CR, all  | N/A       | UUID of a     | UUID of the Neutron     |"},{"line_number":162,"context_line":"|                |        |          |           | valid Neutron | port that needed to be  |"},{"line_number":163,"context_line":"|                |        |          |           | port          | mirrored                |"},{"line_number":164,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":165,"context_line":"| direction      | ENUM   | CRU, all | BOTH      |               | Whether to mirror the   |"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_90b56dd2","line":162,"updated":"2014-12-16 19:33:49.000000000","message":"you should clarify if a given port can be source in multiple tap services","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":159,"context_line":"|                |        |          |           | service UUID  | service instance.       |"},{"line_number":160,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":161,"context_line":"| source_port    | UUID   | CR, all  | N/A       | UUID of a     | UUID of the Neutron     |"},{"line_number":162,"context_line":"|                |        |          |           | valid Neutron | port that needed to be  |"},{"line_number":163,"context_line":"|                |        |          |           | port          | mirrored                |"},{"line_number":164,"context_line":"+----------------+--------+----------+-----------+---------------+-------------------------+"},{"line_number":165,"context_line":"| direction      | ENUM   | CRU, all | BOTH      |               | Whether to mirror the   |"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_7df175cc","line":162,"in_reply_to":"3a961159_90b56dd2","updated":"2014-12-18 18:32:50.000000000","message":"Yes a port can be a source to multiple tap service instances","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":184,"context_line":"  direction_enum \u003d [None, \u0027IN\u0027, \u0027OUT\u0027, \u0027BOTH\u0027]"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"  RESOURCE_ATTRIBUTE_MAP \u003d {"},{"line_number":187,"context_line":"      Tap_Service: {"},{"line_number":188,"context_line":"          \u0027id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":189,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":190,"context_line":"                 \u0027primary_key\u0027: True},"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f2a19c46","line":187,"updated":"2014-12-14 22:11:42.000000000","message":"Tap_Service is a resource name. Please use a string.\n\nIn addition, neutron resources use lower case names. Please follow the convention.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"5387f93f50f0cbb805b7712cd65243da0465cdf3","unresolved":false,"context_lines":[{"line_number":184,"context_line":"  direction_enum \u003d [None, \u0027IN\u0027, \u0027OUT\u0027, \u0027BOTH\u0027]"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"  RESOURCE_ATTRIBUTE_MAP \u003d {"},{"line_number":187,"context_line":"      Tap_Service: {"},{"line_number":188,"context_line":"          \u0027id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":189,"context_line":"                 \u0027validate\u0027: {\u0027type:uuid\u0027: None}, \u0027is_visible\u0027: True,"},{"line_number":190,"context_line":"                 \u0027primary_key\u0027: True},"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_a4fd0b70","line":187,"in_reply_to":"3a961159_f2a19c46","updated":"2014-12-15 09:41:02.000000000","message":"Comment taken, will be addressed in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":200,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":201,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":202,"context_line":"                               \u0027is_visible\u0027: True},"},{"line_number":203,"context_line":"          \u0027network_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":204,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":205,"context_line":"                               \u0027is_visible\u0027: False}"},{"line_number":206,"context_line":"      },"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b2c2b4e6","line":203,"updated":"2014-12-14 22:11:42.000000000","message":"why is network_id required? port_id has network_id attribute and it looks redundant information.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"5387f93f50f0cbb805b7712cd65243da0465cdf3","unresolved":false,"context_lines":[{"line_number":200,"context_line":"          \u0027port_id\u0027: {\u0027allow_post\u0027: False, \u0027allow_put\u0027: False,"},{"line_number":201,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":202,"context_line":"                               \u0027is_visible\u0027: True},"},{"line_number":203,"context_line":"          \u0027network_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"},{"line_number":204,"context_line":"                               \u0027validate\u0027: {\u0027type:uuid\u0027: None},"},{"line_number":205,"context_line":"                               \u0027is_visible\u0027: False}"},{"line_number":206,"context_line":"      },"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_a4598b8f","line":203,"in_reply_to":"3a961159_b2c2b4e6","updated":"2014-12-15 09:41:02.000000000","message":"Creation of the Tap Service instance results in the creation on a neutron port. To be able to create a neutron port, we need to know the network to create it on. Hence we need the network_id. This field had been discussed in previously patch sets of this spec, please refer to them.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":227,"context_line":"  }"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Security impact"},{"line_number":230,"context_line":"---------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"A TaaS instance comprises of a collection of source Neutron ports (whose"},{"line_number":233,"context_line":"ingress and/or egress traffic are being mirrored) and a destination Neutron"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_32aec42e","line":230,"updated":"2014-12-14 22:11:42.000000000","message":"I would like to see the access control discussion above here.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":227,"context_line":"  }"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Security impact"},{"line_number":230,"context_line":"---------------"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"A TaaS instance comprises of a collection of source Neutron ports (whose"},{"line_number":233,"context_line":"ingress and/or egress traffic are being mirrored) and a destination Neutron"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f512d107","line":230,"in_reply_to":"3a961159_32aec42e","updated":"2014-12-18 18:32:50.000000000","message":"Will add more detail in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":239,"context_line":"Ingress Security Group filters, including the filter that prevents MAC-address"},{"line_number":240,"context_line":"spoofing, will be disabled for the destination Neutron port. This will ensure"},{"line_number":241,"context_line":"that all of the mirrored packets received at this port are able to reach the"},{"line_number":242,"context_line":"monitoring VM attached to it."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Source Side:"},{"line_number":245,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_30f4b986","line":242,"updated":"2014-12-16 19:33:49.000000000","message":"I think the user will still be able to control security groups on this port. I guess it\u0027s just something you need to document - but it\u0027s important to note that enabling security groups might affect the functionality of the tap service.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":239,"context_line":"Ingress Security Group filters, including the filter that prevents MAC-address"},{"line_number":240,"context_line":"spoofing, will be disabled for the destination Neutron port. This will ensure"},{"line_number":241,"context_line":"that all of the mirrored packets received at this port are able to reach the"},{"line_number":242,"context_line":"monitoring VM attached to it."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Source Side:"},{"line_number":245,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d4295e8a","line":242,"in_reply_to":"3a961159_30f4b986","updated":"2014-12-18 18:32:50.000000000","message":"Sure, will document it in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":251,"context_line":""},{"line_number":252,"context_line":"However, due to the manner in which Security Groups are currently implemented"},{"line_number":253,"context_line":"in OpenStack (i.e. north of the Open vSwitch ports, using Linux IP Tables) this"},{"line_number":254,"context_line":"is not possible because port mirroring support resides inside Open vSwitch."},{"line_number":255,"context_line":"Therefore, in the first version of TaaS, Security Groups will be ignored for"},{"line_number":256,"context_line":"the source Neutron ports; this effectively translates into capturing ingress"},{"line_number":257,"context_line":"traffic before it passes the inbound Security Group filters and capturing"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2792f34b","line":254,"updated":"2014-12-15 14:54:10.000000000","message":"All things are possible, and OVS is just one driver.  Feel free to design your ideas so that they will work with the OVS driver.  Do not design your APIs around the what the OVS driver is capable of.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":255,"context_line":"Therefore, in the first version of TaaS, Security Groups will be ignored for"},{"line_number":256,"context_line":"the source Neutron ports; this effectively translates into capturing ingress"},{"line_number":257,"context_line":"traffic before it passes the inbound Security Group filters and capturing"},{"line_number":258,"context_line":"egress traffic after it passes the outbound Security Group filters. In other"},{"line_number":259,"context_line":"words, port mirroring will be implemented for all packets entering and/or"},{"line_number":260,"context_line":"leaving the Open vSwitch ports associated with the respective virtual NICs of"},{"line_number":261,"context_line":"the VMs that are being monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_d06c550b","line":258,"updated":"2014-12-16 19:33:49.000000000","message":"This just means pretty much that you will apply the TAP to the OVS bridge only, which is understandable. I think this limitation makes the service itself a bit fake in that it mirrors more than what actually goes into the VM, and should be release-noted","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"911574702b2d1d3bc2f99358674485e4b86b2157","unresolved":false,"context_lines":[{"line_number":255,"context_line":"Therefore, in the first version of TaaS, Security Groups will be ignored for"},{"line_number":256,"context_line":"the source Neutron ports; this effectively translates into capturing ingress"},{"line_number":257,"context_line":"traffic before it passes the inbound Security Group filters and capturing"},{"line_number":258,"context_line":"egress traffic after it passes the outbound Security Group filters. In other"},{"line_number":259,"context_line":"words, port mirroring will be implemented for all packets entering and/or"},{"line_number":260,"context_line":"leaving the Open vSwitch ports associated with the respective virtual NICs of"},{"line_number":261,"context_line":"the VMs that are being monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1d716a44","line":258,"in_reply_to":"3a961159_d06c550b","updated":"2014-12-17 22:04:14.000000000","message":"Agreed, we can mention it in the release notes.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"c41fe65cfc6cd2638d41c5132d56a79cc46bd419","unresolved":false,"context_lines":[{"line_number":264,"context_line":"within OpenvSwitch. A later version of TaaS may make use of this feature, if"},{"line_number":265,"context_line":"and when it is available, so that we can realize the ideal behavior described"},{"line_number":266,"context_line":"above. It should be noted that such an enhancement should not require a change"},{"line_number":267,"context_line":"to the TaaS data model."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1ba1eb93","line":267,"updated":"2014-12-14 03:29:23.000000000","message":"I understand that we had some different opinions on this one in the past.  From Telecom network monitoring point view, some combinations, if not all, of ingress before/after passing the inbound Security Group filter and egress before/after passing the outbound security group filter, will have value for different monitoring requirement. When OpenvSwitch give Openstack the freedom, please consider to give users the options to use different options. I believe this will help Openstack to have better support for NFV\n\nYou may consider the data model and API to have this in mind to avoid change in the future.\n\nFinally, I will like to add that network monitoring with port mirroring is not a option in Telco/NFV. It has been must-have. It used to be done through physical switch/routers. Now we have to extend it to virtual switches and cloud","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"61900ad3adbab87b6a53e9934f03f794d9704014","unresolved":false,"context_lines":[{"line_number":264,"context_line":"within OpenvSwitch. A later version of TaaS may make use of this feature, if"},{"line_number":265,"context_line":"and when it is available, so that we can realize the ideal behavior described"},{"line_number":266,"context_line":"above. It should be noted that such an enhancement should not require a change"},{"line_number":267,"context_line":"to the TaaS data model."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_988156fd","line":267,"in_reply_to":"3a961159_1ba1eb93","updated":"2014-12-15 06:03:53.000000000","message":"For the initial implementation we would like to keep things simple (and which is basically what the Neutron cores have been advising us to do). Therefore, we are targeting mirroring support for virtual NICs, or more precisely the Neutron ports they are associated with. As the spec mentions, the ideal behavior in this case is to establish the tap point north of the Security Group filters. It’s just that given the nature of the existing Security Groups implementation, we are left with no option but to tap south of the Security Group filters. This can be considered to be an interim thing because once Security Groups do get implemented inside Open vSwitch we can get back to our desired tap point north of the Security Group filters. \n\nWe appreciate the suggestion to support other tap locations as part of this feature. It is definitely something that we can consider for a future enhancement (i.e. in addition to tapping south or north of Security Group filters, one may want to tap before the DVR, before or after the load-balancer, etc.). However, this will require more work and some added complexity (even to just define the API) since those points don’t have clearly defined locations, except within a given implementation.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":264,"context_line":"within OpenvSwitch. A later version of TaaS may make use of this feature, if"},{"line_number":265,"context_line":"and when it is available, so that we can realize the ideal behavior described"},{"line_number":266,"context_line":"above. It should be noted that such an enhancement should not require a change"},{"line_number":267,"context_line":"to the TaaS data model."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_15ce7d83","line":267,"in_reply_to":"3a961159_70548121","updated":"2014-12-18 18:32:50.000000000","message":"Ian, Salvatore, Agreed, the option to have the choice of tapping before and after the sec group will be included in the spec, will reflect it in the data model and API in the next patch.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":264,"context_line":"within OpenvSwitch. A later version of TaaS may make use of this feature, if"},{"line_number":265,"context_line":"and when it is available, so that we can realize the ideal behavior described"},{"line_number":266,"context_line":"above. It should be noted that such an enhancement should not require a change"},{"line_number":267,"context_line":"to the TaaS data model."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_e7f0eb92","line":267,"in_reply_to":"3a961159_988156fd","updated":"2014-12-15 14:54:10.000000000","message":"I suggest you make \u0027before\u0027 and \u0027after\u0027 the secgroups two options to the tap, and say that a TaaS implementation can decline to implement either of them.  That would let you implement this for OVS without hobbling the API for other plugins/drivers.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":264,"context_line":"within OpenvSwitch. A later version of TaaS may make use of this feature, if"},{"line_number":265,"context_line":"and when it is available, so that we can realize the ideal behavior described"},{"line_number":266,"context_line":"above. It should be noted that such an enhancement should not require a change"},{"line_number":267,"context_line":"to the TaaS data model."},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_70548121","line":267,"in_reply_to":"3a961159_e7f0eb92","updated":"2014-12-16 19:33:49.000000000","message":"that last suggestion makes sense.\nHowever it is also worth noting that there is no commitment on flow based sec groups, so it\u0027s not a good idea to rely on them.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"},{"line_number":271,"context_line":"shall not be allowed to mirror traffic from any ports that belong to tenants."},{"line_number":272,"context_line":"Hence creation of \u0027Tap_Flow\u0027 is only permitted on ports that are owned by the"},{"line_number":273,"context_line":"creating tenant."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1a943e43","line":271,"updated":"2014-12-16 18:01:39.000000000","message":"I find this odd for a variety of reasons, not the least of which is the fact the tenant is running on the admins equipment. But this does open an interesting discussion for OpenStack clouds which provide this service around the security and privacy aspects of such a service.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10318,"name":"Alan Kavanagh","email":"alan.kavanagh@ericsson.com","username":"lmcakav26"},"change_message_id":"8b80df4ab54b0a3a83e0117a4fc5a1ad8d94d13c","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Keeping data privacy aspects in mind and avoiding the data center admin"},{"line_number":270,"context_line":"from snooping on tenant\u0027s network traffic without their knoledge, the admin"},{"line_number":271,"context_line":"shall not be allowed to mirror traffic from any ports that belong to tenants."},{"line_number":272,"context_line":"Hence creation of \u0027Tap_Flow\u0027 is only permitted on ports that are owned by the"},{"line_number":273,"context_line":"creating tenant."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_58b6b5dd","line":271,"in_reply_to":"3a961159_1a943e43","updated":"2014-12-17 19:04:41.000000000","message":"Agree with Kyle, most operators are legally bound through confidentiality that they do not disclose when traffic or data is being monitored or sent to a third party. This differs from country to country but in the common case, the tenant is not informed when the traffic is being monitored etc.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"e9cd9ecb70e257b0fea9730f783c465a8f77a37e","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If an admin wants to monitor tenant\u0027s traffic, the admin will have to join that"},{"line_number":276,"context_line":"tenant as a member. This will ensure that the tenant is aware that the admin"},{"line_number":277,"context_line":"might be monitoring their traffic."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_72a4cc4a","line":277,"updated":"2014-12-14 22:11:42.000000000","message":"why? admin is super-user and I think admin can monitor any traffic.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"2c1c28f9cceb1ae9d59a9fc592936b52f2afb4fb","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If an admin wants to monitor tenant\u0027s traffic, the admin will have to join that"},{"line_number":276,"context_line":"tenant as a member. This will ensure that the tenant is aware that the admin"},{"line_number":277,"context_line":"might be monitoring their traffic."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_931857d4","line":277,"in_reply_to":"3a961159_72a4cc4a","updated":"2014-12-15 06:55:35.000000000","message":"During the Juno cycle, when this project was regularly discussed in the Neutron Advanced Services IRC Meeting, some folks were concerned that Tap-as-a-Service could be used by the Datacenter admin to ‘silently’ monitor tenant traffic. Although it is always possible for the admin to do this by other means, they didn’t want an OpenStack service to permit this out-of-the-box.\n\nOur proposal is therefore to disallow anyone who is not part of a tenant from monitoring that tenant’s traffic. If the datacenter admin wishes to monitor a tenant’s traffic, the admin will have to join that tenant as a member.  Since an admin should be able to join any tenant, this allows the admin to do whatever he/she wishes (as the super-user), while ensuring that it is not done in a silent fashion.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If an admin wants to monitor tenant\u0027s traffic, the admin will have to join that"},{"line_number":276,"context_line":"tenant as a member. This will ensure that the tenant is aware that the admin"},{"line_number":277,"context_line":"might be monitoring their traffic."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_da81d6fc","line":277,"in_reply_to":"3a961159_931857d4","updated":"2014-12-16 18:01:39.000000000","message":"I agree with Akihiro, this seems silly. Admin can do whatever she/he needs, including monitoring any tenant\u0027s traffic.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10318,"name":"Alan Kavanagh","email":"alan.kavanagh@ericsson.com","username":"lmcakav26"},"change_message_id":"8b80df4ab54b0a3a83e0117a4fc5a1ad8d94d13c","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If an admin wants to monitor tenant\u0027s traffic, the admin will have to join that"},{"line_number":276,"context_line":"tenant as a member. This will ensure that the tenant is aware that the admin"},{"line_number":277,"context_line":"might be monitoring their traffic."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_98b01ddf","line":277,"in_reply_to":"3a961159_da81d6fc","updated":"2014-12-17 19:04:41.000000000","message":"+1 same as comment above.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If an admin wants to monitor tenant\u0027s traffic, the admin will have to join that"},{"line_number":276,"context_line":"tenant as a member. This will ensure that the tenant is aware that the admin"},{"line_number":277,"context_line":"might be monitoring their traffic."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2d1c6613","line":277,"in_reply_to":"3a961159_da81d6fc","updated":"2014-12-16 19:33:49.000000000","message":"While I have no opposition to your decision about this privacy model, I would just note that it\u0027s rather pointless considering that in practice the admin (ie: the cloud operator) can even read tenants\u0027 instances memory...","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":10780,"name":"Maruti Kamat","email":"maruti.kamat@hp.com","username":"marutik"},"change_message_id":"45c7ee355bb64d8e0bdf319856518fe21eb6960d","unresolved":false,"context_lines":[{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A set of new RCP calls for communication between the TaaS server and agents"},{"line_number":283,"context_line":"are required and will be put in place as part of the reference implementation."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"IPv6 impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b44abd52","line":282,"updated":"2014-12-12 17:25:08.000000000","message":"RPC","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"61900ad3adbab87b6a53e9934f03f794d9704014","unresolved":false,"context_lines":[{"line_number":279,"context_line":"Notifications impact"},{"line_number":280,"context_line":"--------------------"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A set of new RCP calls for communication between the TaaS server and agents"},{"line_number":283,"context_line":"are required and will be put in place as part of the reference implementation."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"IPv6 impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b884520b","line":282,"in_reply_to":"3a961159_b44abd52","updated":"2014-12-15 06:03:53.000000000","message":"Will fix.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"The performance impact of mirroring traffic needs to be examined and"},{"line_number":299,"context_line":"quantified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":300,"context_line":"all ports could be large and needs more examination."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Some alternatives to reduce the amount of mirrored traffic are listed below."},{"line_number":303,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_47cd3f30","line":300,"updated":"2014-12-15 14:54:10.000000000","message":"Billing.  If it\u0027s hard, how do you bill for it?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"The performance impact of mirroring traffic needs to be examined and"},{"line_number":299,"context_line":"quantified. The impact of a tenant potentially mirroring all traffic from"},{"line_number":300,"context_line":"all ports could be large and needs more examination."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Some alternatives to reduce the amount of mirrored traffic are listed below."},{"line_number":303,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_c998eb1d","line":300,"in_reply_to":"3a961159_47cd3f30","updated":"2014-12-18 18:32:50.000000000","message":"One way to bill is to collect statistics from the Tap Service destination port which receives all the mirrored data.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":305,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be"},{"line_number":306,"context_line":"     mirrored."},{"line_number":307,"context_line":"  3. Having a quota on the number of TaaS Flows that can be defined by the"},{"line_number":308,"context_line":"     tenant."},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"Other deployer impact"},{"line_number":311,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5005c512","line":308,"updated":"2014-12-16 19:33:49.000000000","message":"the latter seems to be the only easily feasible one.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":305,"context_line":"  2. Filters to select certain flows ingressing/egressing a port to be"},{"line_number":306,"context_line":"     mirrored."},{"line_number":307,"context_line":"  3. Having a quota on the number of TaaS Flows that can be defined by the"},{"line_number":308,"context_line":"     tenant."},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"Other deployer impact"},{"line_number":311,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_15959d3f","line":308,"in_reply_to":"3a961159_5005c512","updated":"2014-12-18 18:32:50.000000000","message":"Sure","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":324,"context_line":"Follow up work"},{"line_number":325,"context_line":"--------------"},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"Going forward, TaaS would be incorporated with Service Insertion [2]_ similar"},{"line_number":328,"context_line":"to other existing services like FWaaS, LBaaS, and VPNaaS."},{"line_number":329,"context_line":""},{"line_number":330,"context_line":"While integrating Tap-as-a-Service with Service Insertion the key changes to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3a9f3a52","line":327,"updated":"2014-12-16 18:01:39.000000000","message":"I was waiting for this spec to bring up service insertion.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":327,"context_line":"Going forward, TaaS would be incorporated with Service Insertion [2]_ similar"},{"line_number":328,"context_line":"to other existing services like FWaaS, LBaaS, and VPNaaS."},{"line_number":329,"context_line":""},{"line_number":330,"context_line":"While integrating Tap-as-a-Service with Service Insertion the key changes to"},{"line_number":331,"context_line":"the data model needed would be the removal of \u0027network_id\u0027 and \u0027port_id\u0027 from"},{"line_number":332,"context_line":"the \u0027Tap_Service\u0027 data model."},{"line_number":333,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5aac068d","line":330,"updated":"2014-12-16 18:01:39.000000000","message":"I think it\u0027s a bit premature to mention work around service insertion, given it\u0027s not on an official roadmap.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":329,"context_line":""},{"line_number":330,"context_line":"While integrating Tap-as-a-Service with Service Insertion the key changes to"},{"line_number":331,"context_line":"the data model needed would be the removal of \u0027network_id\u0027 and \u0027port_id\u0027 from"},{"line_number":332,"context_line":"the \u0027Tap_Service\u0027 data model."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"Implementation"},{"line_number":335,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2be60e17","line":332,"updated":"2014-12-16 19:33:49.000000000","message":"I agree that specs should not make an assumption on other specs for which there is no commitment yet. However, from this description it seems that if service insertion is never approved this won\u0027t be a problem for the tap service.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":329,"context_line":""},{"line_number":330,"context_line":"While integrating Tap-as-a-Service with Service Insertion the key changes to"},{"line_number":331,"context_line":"the data model needed would be the removal of \u0027network_id\u0027 and \u0027port_id\u0027 from"},{"line_number":332,"context_line":"the \u0027Tap_Service\u0027 data model."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"Implementation"},{"line_number":335,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_2926cf16","line":332,"in_reply_to":"3a961159_2be60e17","updated":"2014-12-18 18:32:50.000000000","message":"True, we do not \u0027depend\u0027 on service insertion","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":338,"context_line":"addition to the existing integration (br-int) and tunnel (br-tun) bridges, a"},{"line_number":339,"context_line":"separate tap bridge (br-tap) will be used. The tap bridge provides nice"},{"line_number":340,"context_line":"isolation for supporting more complex TaaS features (e.g. filtering mirrored"},{"line_number":341,"context_line":"packets) in the future. "},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"The tapping operation will be realized by adding higher priority flows in"},{"line_number":344,"context_line":"br-int, which duplicate the ingress and/or egress packets associated with"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1ac99e5a","line":341,"updated":"2014-12-16 18:01:39.000000000","message":"Another bridge? I think this needs mention in the Deploy Impact section.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":338,"context_line":"addition to the existing integration (br-int) and tunnel (br-tun) bridges, a"},{"line_number":339,"context_line":"separate tap bridge (br-tap) will be used. The tap bridge provides nice"},{"line_number":340,"context_line":"isolation for supporting more complex TaaS features (e.g. filtering mirrored"},{"line_number":341,"context_line":"packets) in the future. "},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"The tapping operation will be realized by adding higher priority flows in"},{"line_number":344,"context_line":"br-int, which duplicate the ingress and/or egress packets associated with"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6bf016ca","line":341,"in_reply_to":"3a961159_1ac99e5a","updated":"2014-12-16 19:33:49.000000000","message":"How \u0026 when the new bridge is created should be discussed.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"fb454884886ebc21cc16dfef0fbcb5f135869dab","unresolved":false,"context_lines":[{"line_number":338,"context_line":"addition to the existing integration (br-int) and tunnel (br-tun) bridges, a"},{"line_number":339,"context_line":"separate tap bridge (br-tap) will be used. The tap bridge provides nice"},{"line_number":340,"context_line":"isolation for supporting more complex TaaS features (e.g. filtering mirrored"},{"line_number":341,"context_line":"packets) in the future. "},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"The tapping operation will be realized by adding higher priority flows in"},{"line_number":344,"context_line":"br-int, which duplicate the ingress and/or egress packets associated with"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_6098051c","line":341,"in_reply_to":"3a961159_6bf016ca","updated":"2014-12-17 23:49:02.000000000","message":"The br-tap bridge is needed on a host when at least one port (from the br-int bridge) on that host is serving as a source port or the destination port of a tap service instance.  Therefore, it can be created during the process of associating the ‘first’ port (source or destination) on that host with a tap service instance.\n\nIf there are no ports (source or destination) on a host that are associated with a tap service instance, then there will be no tap related flows in the br-int and br-tun bridges on that host to drive traffic into the br-tap bridge. Therefore, it should be safe to leave the br-tap bridge around. Or in other words, once created it does not need to be removed.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":341,"context_line":"packets) in the future. "},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"The tapping operation will be realized by adding higher priority flows in"},{"line_number":344,"context_line":"br-int, which duplicate the ingress and/or egress packets associated with"},{"line_number":345,"context_line":"specific ports (belonging to the VMs being monitored) and send the copies to"},{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_4b36fae8","line":344,"updated":"2014-12-16 19:33:49.000000000","message":"that\u0027s going to have some data plane performance impact also for non-mirrored ports imho, but we\u0027ll see","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":345,"context_line":"specific ports (belonging to the VMs being monitored) and send the copies to"},{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"},{"line_number":348,"context_line":"VLAN ids may be reserved from highest to lowest; in later releases it should be"},{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_cb302aa1","line":348,"updated":"2014-12-16 19:33:49.000000000","message":"These tags are then sent over the tunnel and used to discriminate the destination tap service. Does this mean that the destination tap service port is going to be tagged in this way? While I might find acceptable that this would be tantamount to a port which can\u0027t talk to other ports on the same network, I think some more details should be provided.\n\nSpecifically:\n1) How to ensure no clashes betwen tap service tags and tags used internally into br-int instances?\n\n2) What changes are required to the ovs agent port wiring process, if any?","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"fb454884886ebc21cc16dfef0fbcb5f135869dab","unresolved":false,"context_lines":[{"line_number":345,"context_line":"specific ports (belonging to the VMs being monitored) and send the copies to"},{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"},{"line_number":348,"context_line":"VLAN ids may be reserved from highest to lowest; in later releases it should be"},{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_568bcf1d","line":348,"in_reply_to":"3a961159_cb302aa1","updated":"2014-12-17 23:49:02.000000000","message":"The destination port of a tap service instance will not be tagged in any special way by TaaS. \n\nTaaS will use VLAN ids and tunnel ids to isolate the mirrored traffic of different tap service instances from each other and from normal (non-mirrored) traffic. Whenever a new mirrored packet is created (duplicated from the original packet) or when a new mirrored packet arrives via a tunnel from a remote host, will be tagged with a VLAN id associated with the tap service instance it belongs to. This tap service VLAN id will be removed when the packet is either delivered to the destination port of the tap service instance or it leaves the host via a tunnel. When the mirrored packet is traversing a tunnel it will be encapsulated using a tunnel ID associated with the tap service instance. \n\nFinally, as the last step before delivering the mirrored packet to the destination port, it will be appropriately tagged with the (original) Neutron assigned VLAN id for that port based on the tenant network it belongs to.\n\nTo avoid clashes between VLAN ids and tunnel ids used by TaaS and those used by Neutron to isolate tenant network traffic, we need some coordination with Neutron, as mentioned above. \n\nWe don\u0027t anticipate any changes to the OVS port wiring process.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"},{"line_number":348,"context_line":"VLAN ids may be reserved from highest to lowest; in later releases it should be"},{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_c7868fb8","line":349,"updated":"2014-12-15 14:54:10.000000000","message":"Unclear why co-ordination is needed, and I think the parenthetical statement could be removed as it doesn\u0027t add anything.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"fb454884886ebc21cc16dfef0fbcb5f135869dab","unresolved":false,"context_lines":[{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"},{"line_number":348,"context_line":"VLAN ids may be reserved from highest to lowest; in later releases it should be"},{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b6c9535c","line":349,"in_reply_to":"3a961159_8b30e2e9","updated":"2014-12-17 23:49:02.000000000","message":"We mentioned coordination to ensure that the VLAN ids and tunnel ids used by TaaS (to isolate the mirrored traffic belonging to different tap service instances from each other and from non-mirrored traffic) don\u0027t clash with the VLAN ids and tunnel ids used by Neutron (to isolate tenant network traffic).\n\nIf there is some other way to ensure that there is no clash (e.g. a reservation system) we would like to be made aware of it.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"4d6b92e51079c7e5b30ff240ea841d9732d51970","unresolved":false,"context_lines":[{"line_number":346,"context_line":"br-tap. Packets sent to br-tap will also be tagged with an appropriate VLAN id"},{"line_number":347,"context_line":"corresponding to the associated TaaS instance (in the initial release these"},{"line_number":348,"context_line":"VLAN ids may be reserved from highest to lowest; in later releases it should be"},{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_8b30e2e9","line":349,"in_reply_to":"3a961159_c7868fb8","updated":"2014-12-16 19:33:49.000000000","message":"agreed","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":12057,"name":"Bao Wang","email":"baowang98@yahoo.com"},"change_message_id":"c41fe65cfc6cd2638d41c5132d56a79cc46bd419","unresolved":false,"context_lines":[{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"Flows will be placed in br-tap to determine if the mirrored traffic should be"},{"line_number":354,"context_line":"sent to br-tun or not. If the destination port of a Tap-aaS instance happens to"},{"line_number":355,"context_line":"reside on the same host as a source port, packets from that source port will be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5bbe13af","line":352,"updated":"2014-12-14 03:29:23.000000000","message":"I do not have deep knowledge with the current neutron implementation. Simply from the neutron documentation and the explanation in this spec, I could not follow why br-tap will be needed. I might miss some dots. But I could not see anything that br-tap brings that br-int would not be able to.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11578,"name":"Anil Rao","email":"arao012@gmail.com","username":"arao"},"change_message_id":"61900ad3adbab87b6a53e9934f03f794d9704014","unresolved":false,"context_lines":[{"line_number":349,"context_line":"coordinated with the Neutron service). The original packets will continue to be"},{"line_number":350,"context_line":"processed normally, so as not to affect the traffic patterns of the VMs being"},{"line_number":351,"context_line":"monitored."},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"Flows will be placed in br-tap to determine if the mirrored traffic should be"},{"line_number":354,"context_line":"sent to br-tun or not. If the destination port of a Tap-aaS instance happens to"},{"line_number":355,"context_line":"reside on the same host as a source port, packets from that source port will be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_98e796ab","line":352,"in_reply_to":"3a961159_5bbe13af","updated":"2014-12-15 06:03:53.000000000","message":"Our primary reason for using br-tap, a separate bridge, is because it easily leads to a cleaner design (separation of concerns) and provides some degree of independence for incorporating more advanced TaaS features in the future, without affecting other services. \n\nIt should be mentioned that it is possible to implement TaaS without requiring this extra bridge. However, at this point we don’t see a clear process/policy for how br-int’s pipeline is to be shared with the other services. Maintaining our own bridge helps simplify things considerably. If the community strongly feels that we should only work with br-int, we will move our flow table entries from br-tap to br-int (with some modifications).","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"d37e9a228ef907871d6082479c66e03ae847404b","unresolved":false,"context_lines":[{"line_number":394,"context_line":""},{"line_number":395,"context_line":"* Unit Tests to be added."},{"line_number":396,"context_line":"* Functional tests in tempest to be added."},{"line_number":397,"context_line":"* API Tests in Tempest to be added."},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"Documentation Impact"},{"line_number":400,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_ba088a92","line":397,"updated":"2014-12-16 18:01:39.000000000","message":"I think there is a distinct lack of tests listed here. Functional tests would need to be fleshed out. I\u0027d also expect a spec filed in QA for the tempest tests needed for this. I see neither here.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":394,"context_line":""},{"line_number":395,"context_line":"* Unit Tests to be added."},{"line_number":396,"context_line":"* Functional tests in tempest to be added."},{"line_number":397,"context_line":"* API Tests in Tempest to be added."},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"Documentation Impact"},{"line_number":400,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_e9fe876a","line":397,"in_reply_to":"3a961159_ba088a92","updated":"2014-12-18 18:32:50.000000000","message":"The details of tempest test cases required will be added soon.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":406,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":407,"context_line":""},{"line_number":408,"context_line":".. [1] External port"},{"line_number":409,"context_line":"   https://review.openstack.org/#/c/87825"},{"line_number":410,"context_line":""},{"line_number":411,"context_line":".. [2] Service base and insertion"},{"line_number":412,"context_line":"   https://review.openstack.org/#/c/93128"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_673a3be8","line":409,"updated":"2014-12-15 14:54:10.000000000","message":"Dead, and in any case not the only proposal of implementation for external traffic transfer, none of which has yet won the day.  I suggest you skip this and the comment above.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":406,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":407,"context_line":""},{"line_number":408,"context_line":".. [1] External port"},{"line_number":409,"context_line":"   https://review.openstack.org/#/c/87825"},{"line_number":410,"context_line":""},{"line_number":411,"context_line":".. [2] Service base and insertion"},{"line_number":412,"context_line":"   https://review.openstack.org/#/c/93128"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_b58be91c","line":409,"in_reply_to":"3a961159_673a3be8","updated":"2014-12-18 18:32:50.000000000","message":"Ian, will remove it in the next patch","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":3217,"name":"Ian Wells","username":"ijw-ubuntu"},"change_message_id":"364ef64b210dc2d52ab48d5c297db97135be1b2d","unresolved":false,"context_lines":[{"line_number":412,"context_line":"   https://review.openstack.org/#/c/93128"},{"line_number":413,"context_line":""},{"line_number":414,"context_line":".. [3] NFV unaddressed interfaces"},{"line_number":415,"context_line":"   https://review.openstack.org/#/c/97715/"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_a760a301","line":415,"updated":"2014-12-15 14:54:10.000000000","message":"Dead: you want the port security BP","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"},{"author":{"_account_id":11674,"name":"vinay yadhav","email":"vinay.yadhav@ericsson.com","username":"vnyyad"},"change_message_id":"939445915f036c0683066df3e38064e59222b3b4","unresolved":false,"context_lines":[{"line_number":412,"context_line":"   https://review.openstack.org/#/c/93128"},{"line_number":413,"context_line":""},{"line_number":414,"context_line":".. [3] NFV unaddressed interfaces"},{"line_number":415,"context_line":"   https://review.openstack.org/#/c/97715/"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_5576453f","line":415,"in_reply_to":"3a961159_a760a301","updated":"2014-12-18 18:32:50.000000000","message":"will take care of this too.","commit_id":"054aa9d9b7f376fc94bbdcaca47f700c2bf3ff33"}]}