Tracing packets in OVS: an update on Retis#

Speakers: Paolo Valerio, Adrian Moreno, Red Hat, Inc.

Why: eBPF-based packet tracing that follows packets across the kernel stack, the OVS datapath, and userspace upcalls — the visibility gap most tools leave.

What: Retis is a network tracing tool where OVS is a first-class citizen: eBPF programs on tracepoints/kprobes plus USDT probes in ovs-vswitchd (requires --enable-usdt-probes) to track a packet from upcall through action execution. New since last cycle: Python bindings (pyo3, on PyPI, with an embedded shell) and OVS flow enrichment — a kretprobe on ovs_flow_tbl_lookup_stats captures the UFID, then Retis queries ovs-vswitchd at runtime via dpctl/get-flow and ofproto/detrace (throttled and cached) to attach the full datapath and OpenFlow flows to trace events.

How: Event series show a single curl packet with its conntrack NAT actions annotated inline; limitations honestly stated (no reliable tracking of flow deletion/update, upcall flows not displayable).

Where applicable: Linux + OVS kernel datapath debugging; valuable for anyone who has tried to answer "what did OVS do to this packet" with tcpdump and failed.