OpenFlow Classifier: Arcane knowledge and common pitfalls#

Ilya Maximets (Red Hat)

• Why: The classifier is the hottest path in OVS and determines megaflow quality, which drives datapath autonomy and flow-cache effectiveness. Understanding its subtable model explains OVN pipeline performance and recent regressions and fixes — core datapath-internals material, delivered by a current maintainer.
• What: A deep dive: rules are grouped by match pattern into per-mask hash "subtables"; lookup iterates subtables ordered by the highest priority they contain; complexity is O(1) per subtable hit and O(n) over distinct masks. "Un-wildcarding" produces the megaflow mask — false 1-bits are allowed but degrade caching; false 0-bits are correctness bugs. Optimizations covered: staged lookup (the mask split into 4 segments with early exit, sharply reducing un-wildcarded bits for non-matching packets) and prefix tracking. Pitfalls: mask explosion from many distinct match patterns, and historically from OVN's inequality matches (single-bit masks, fixed October 2025 to use prefixes; IPv6 address pairs can still theoretically yield 128×128 masks).
• How: Practical do/don't guidance for OpenFlow pipeline authors: match earlier-stage fields alongside later ones where logic permits, never let struct flow dependencies cross segment boundaries, and avoid generating fragmented masks.
• Where applicable: Every OVS deployment; especially relevant to OVN logical-flow generation and anyone reading megaflow traces.