[{"id":3243098,"web_url":"http://patchwork.ozlabs.org/comment/3243098/","msgid":"<20240108135041.2265747-1-robot@bytheb.org>","list_archive_url":null,"date":"2024-01-08T13:50:41","subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n\tNB_Global options.","submitter":{"id":74326,"url":"http://patchwork.ozlabs.org/api/people/74326/","name":"0-day Robot","email":"robot@bytheb.org"},"content":"References: <20240108130004.51995-1-priyankar.jain@nutanix.com>\n \n\nBleep bloop. Greetings Priyankar Jain, I am a robot and I have tried out your patch.\nThanks for your contribution.\n\nI encountered some error that I wasn't expecting. See the details below.\n\n\ncheckpatch:\nWARNING: Line is 81 characters long (recommended limit is 79)\n#84 FILE: northd/northd.c:8244:\n \"eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4\",\n\nWARNING: Line is 84 characters long (recommended limit is 79)\n#93 FILE: northd/northd.c:10331:\n \"(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4)\"\n\nLines checked: 624, Warnings: 2, Errors: 0\n\n\nPlease check this out. If you feel there has been an error, please email aconole@redhat.com\n\nThanks,\n0-day Robot","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=bytheb-org.20230601.gappssmtp.com\n header.i=@bytheb-org.20230601.gappssmtp.com header.a=rsa-sha256\n header.s=20230601 header.b=t024+OuU;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::137; helo=smtp4.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp4.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=bytheb-org.20230601.gappssmtp.com\n header.i=@bytheb-org.20230601.gappssmtp.com header.a=rsa-sha256\n header.s=20230601 header.b=t024+OuU"],"Received":["from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4T7wSX2X7Rz1yPX\n\tfor ; Tue, 9 Jan 2024 00:50:50 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id 363F1417C7;\n\tMon, 8 Jan 2024 13:50:48 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n\tby localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id FcstRoCCNsL5; Mon, 8 Jan 2024 13:50:47 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp4.osuosl.org (Postfix) with ESMTPS id 6BDAD417C2;\n\tMon, 8 Jan 2024 13:50:46 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 3C7EDC0077;\n\tMon, 8 Jan 2024 13:50:46 +0000 (UTC)","from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 30E3FC0037\n for ; Mon, 8 Jan 2024 13:50:45 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp4.osuosl.org (Postfix) with ESMTP id 0606A417C7\n for ; Mon, 8 Jan 2024 13:50:45 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n with ESMTP id ejC7quA-lrS3 for ;\n Mon, 8 Jan 2024 13:50:44 +0000 (UTC)","from mail-oi1-x22e.google.com (mail-oi1-x22e.google.com\n [IPv6:2607:f8b0:4864:20::22e])\n by smtp4.osuosl.org (Postfix) with ESMTPS id 5BE28417C2\n for ; Mon, 8 Jan 2024 13:50:44 +0000 (UTC)","by mail-oi1-x22e.google.com with SMTP id\n 5614622812f47-3bbd6e37af4so1865823b6e.1\n for ; Mon, 08 Jan 2024 05:50:44 -0800 (PST)","from openvswitch-ci.ntdv.lab.eng.bos.redhat.com\n (nat-pool-bos-t.redhat.com. [66.187.233.206])\n by smtp.gmail.com with ESMTPSA id\n dz1-20020ad45881000000b0067f454b5307sm2833586qvb.108.2024.01.08.05.50.42\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 08 Jan 2024 05:50:42 -0800 (PST)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp4.osuosl.org 363F1417C7","OpenDKIM Filter v2.11.0 smtp4.osuosl.org 6BDAD417C2","OpenDKIM Filter v2.11.0 smtp4.osuosl.org 0606A417C7","OpenDKIM Filter v2.11.0 smtp4.osuosl.org 5BE28417C2"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=bytheb-org.20230601.gappssmtp.com; s=20230601; t=1704721843; x=1705326643;\n darn=openvswitch.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=MCEQBAKjW7Ksuj1XYyjO1Rghs8dmcuNOyLI3P5njKlA=;\n b=t024+OuU827M/cuo7p3c0JYqOL8VUDXv6x9fZjCjut8o7K/x2zuV7yysMiQS6Onnb6\n CrLdVWPsUFUiyawod1aKXxOJ/uIdjuRSAbvjBmjIvlSl+YGG9kkKF/QKVlGbWfjV3qiq\n sfwig1v78jIlYN9u+E4hMWk0YZwZL/BFSQW9opBtwBorogsGnOsEPG2uxJcIObFIaM6+\n AHTbzlLYWsv2JAjsb/Br2kxzdb0Q4NxbfQ7LVUhD9ndBaO25L9MHeuKcNAaGo6sZrGTq\n 6vZxvQNF/EvNgmmUmTDeQr4PbPUPcGbykQHZk0tQNMsgTFwABiBwZ5koWvIpaOlUgv5/\n ZbVQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1704721843; x=1705326643;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc\n :subject:date:message-id:reply-to;\n bh=MCEQBAKjW7Ksuj1XYyjO1Rghs8dmcuNOyLI3P5njKlA=;\n b=YNu6LlhJWWV5QFSpJjFDRjxV0TYjt4KWomzMicZBkQMVNom0hBHxqTr0TUNHCCgKtk\n BIuqOfTD9QE19dzv2/x3qFdI2pl1XKOGooUB5+kyLu+tk7kQQh0x1nj63h/nV8Tb5SIJ\n Zl6PXLbojs6FLqnszFvqr7MgfS+PRajUoC63gIePgqd4/PQ/UFb6QA8bndXGIC07udTB\n xB779uXhbKtwHqYEOWWIprXD/h9ogtNXApulj+gAV8xgM0X5TO1DuEfeCxCixBDaQB2V\n dIaHU9HavboSsOUXStfozU2nN0+skjn8yiuaPM5/9qkG8XTcUeirfnvm5ryH0j/J9CW4\n 7l2Q==","X-Gm-Message-State":"AOJu0YzrSRY+hkaBvkMMYNOGABrYjaIXYDyUzbKqrOC+8ywuJ0VA0ew8\n PpMQXLBmAvRqiafeZOn2+YjzlVa0roEvE2PT6YLV+FbRby8=","X-Google-Smtp-Source":"\n AGHT+IHSc6ghsDoHsPr4LhZ5KIpW2QhuYk1hbEk4r/F/18hmSHaoz6rjsJj+HEp7+IyFxu7QiYQJtQ==","X-Received":"by 2002:a05:6808:2123:b0:3bd:26c7:2a2e with SMTP id\n r35-20020a056808212300b003bd26c72a2emr3428448oiw.48.1704721843287;\n Mon, 08 Jan 2024 05:50:43 -0800 (PST)","From":"0-day Robot ","To":"Priyankar Jain ","Date":"Mon, 8 Jan 2024 08:50:41 -0500","Message-Id":"<20240108135041.2265747-1-robot@bytheb.org>","X-Mailer":"git-send-email 2.27.0","In-Reply-To":"<20240108130004.51995-1-priyankar.jain@nutanix.com>","References":"","MIME-Version":"1.0","Cc":"dev@openvswitch.org","Subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n\tNB_Global options.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.15","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "}},{"id":3257288,"web_url":"http://patchwork.ozlabs.org/comment/3257288/","msgid":"","list_archive_url":null,"date":"2024-02-02T03:14:56","subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n NB_Global options.","submitter":{"id":71978,"url":"http://patchwork.ozlabs.org/api/people/71978/","name":"Mark Michelson","email":"mmichels@redhat.com"},"content":"Hi Priyankar,\n\nI'm not sure I understand the purpose of this patch. Even without this \npatch, you could configure whatever IP address you want in the \nip_port_mappings as the source address for the health checks. I don't \nsee anything in the code that restricts the IP to be within the subnet \nof the backend IP address. And even if there is such a restriction, I \ndon't see anything in this patch that lifts that restriction.\n\nThe extra matches added in this patch (eth.dst == $svc_monitor_mac || \nip4.dst == $svc_monitor_ip4) don't make much sense to me either. When \nOVN sends a health check, the reply from the backend will have eth.dst \nset to the service monitor MAC address. Since the existing matches do \nnot care what the destination IPv4 address is, the existing match should \nwork fine. If there was something in the code that was dropping packets \naddressed to IP addresses outside the subnet of the configured load \nbalancer backends, this patch doesn't appear to be doing anything to \nprevent such droppage.\n\nAnd finally, if I'm mistaken about my above two points, then my final \nproblem with this patch is that it only adds support for IPv4. I noticed \nthat in the documentation for the Service_Monitor table in the \nsouthbound database, it claims that \"Service monitoring for IPv6 \nservices is not supported.\" And the \"src_ip\" field is documented as \n\"Source IPv4 address to use in the service monitor packet.\" \nUnfortunately, these are inaccurate. IPv6 service monitoring was added \nas a feature about 3 months after the initial IPv4 service monitoring \nwas added. Unfortunately, it looks as though we did not update the \ndocumentation, and we need to get this fixed. However, the northbound \nload balancer health check documentation makes it clear that IPv6 is \nsupported, and the code also has support for IPv6 in it. So if I'm \nincorrect in the first two paragraphs and this option is really needed, \nthen it needs to support IPv6 as well.\n\nThanks,\nMark Michelson\n\nOn 1/8/24 08:00, Priyankar Jain wrote:\n> This commit adds a new optional svc_monitor_ipv4 config in the NB_Global\n> options column. This IP address can be used to send the packets to the\n> OVN controller bypassing most of the logical switches pipelines.\n> \n> Usage: Currently Load balancer health check requires a source IP address\n> to be allocated from the subnets where backends are present.\n> This change removes that requirement and instead user can give one IP\n> address for the system and set it in NB_Global:options:svc_monitor_ipv4.\n> While configuring the health check for the load balancer user can\n> provide this same IP while specifying the ip-port mappings.\n> \n> Signed-off-by: Priyankar Jain \n> ---\n> \n> Changes since v1:\n> - Fixed one testcase in ovn-northd.at\n> \n> ---\n> northd/en-sync-sb.c | 10 +++++\n> northd/northd.c | 34 +++++++++++++--\n> northd/northd.h | 1 +\n> northd/ovn-northd.8.xml | 40 +++++++++++------\n> tests/ovn-northd.at | 96 ++++++++++++++++++++---------------------\n> 5 files changed, 116 insertions(+), 65 deletions(-)\n> \n> diff --git a/northd/en-sync-sb.c b/northd/en-sync-sb.c\n> index 2ec3bf54f..95e9ead29 100644\n> --- a/northd/en-sync-sb.c\n> +++ b/northd/en-sync-sb.c\n> @@ -372,6 +372,16 @@ sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,\n> sync_addr_set(ovnsb_txn, \"svc_monitor_mac\", &svc, &sb_address_sets);\n> sorted_array_destroy(&svc);\n> \n> + /* Service monitor IP. */\n> + const char *svc_monitor_ip4 = northd_get_svc_monitor_ip4();\n> + int num_addr = 0; /* Create empty address-set by default */\n> + if (svc_monitor_ip4) {\n> + num_addr = 1;\n> + }\n> + struct sorted_array ip_svc = sorted_array_create(&svc_monitor_ip4,\n> + num_addr, false);\n> + sync_addr_set(ovnsb_txn, \"svc_monitor_ip4\", &ip_svc, &sb_address_sets);\n> +\n> /* sync port group generated address sets first */\n> const struct nbrec_port_group *nb_port_group;\n> NBREC_PORT_GROUP_TABLE_FOR_EACH (nb_port_group,\n> diff --git a/northd/northd.c b/northd/northd.c\n> index db3cd272e..f6d35143a 100644\n> --- a/northd/northd.c\n> +++ b/northd/northd.c\n> @@ -82,6 +82,7 @@ static bool use_common_zone = false;\n> static char svc_monitor_mac[ETH_ADDR_STRLEN + 1];\n> static struct eth_addr svc_monitor_mac_ea;\n> \n> +static char *svc_monitor_ip4 = NULL;\n> /* If this option is 'true' northd will make use of ct.inv match fields.\n> * Otherwise, it will avoid using it. The default is true. */\n> static bool use_ct_inv_match = true;\n> @@ -7197,7 +7198,8 @@ build_pre_acls(struct ovn_datapath *od,\n> ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 0, \"1\", \"next;\");\n> \n> ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110,\n> - \"eth.dst == $svc_monitor_mac\", \"next;\");\n> + \"eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4\",\n> + \"next;\");\n> \n> ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110,\n> \"eth.src == $svc_monitor_mac\", \"next;\");\n> @@ -7370,7 +7372,8 @@ build_pre_lb(struct ovn_datapath *od, const struct shash *meter_groups,\n> \n> /* Do not send service monitor packets to conntrack. */\n> ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_LB, 110,\n> - \"eth.dst == $svc_monitor_mac\", \"next;\");\n> + \"eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4\",\n> + \"next;\");\n> ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_LB, 110,\n> \"eth.src == $svc_monitor_mac\", \"next;\");\n> \n> @@ -8238,7 +8241,7 @@ build_acls(struct ovn_datapath *od, const struct chassis_features *features,\n> /* Add a 34000 priority flow to advance the service monitor reply\n> * packets to skip applying ingress ACLs. */\n> ovn_lflow_add(lflows, od, S_SWITCH_IN_ACL_EVAL, 34000,\n> - \"eth.dst == $svc_monitor_mac\",\n> + \"eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4\",\n> REGBIT_ACL_VERDICT_ALLOW\" = 1; next;\");\n> \n> /* Add a 34000 priority flow to advance the service monitor packets\n> @@ -10325,7 +10328,8 @@ build_lswitch_destination_lookup_bmcast(struct ovn_datapath *od,\n> ovs_assert(od->nbs);\n> \n> ovn_lflow_metered(lflows, od, S_SWITCH_IN_L2_LKUP, 110,\n> - \"eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)\",\n> + \"(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4)\"\n> + \" && (tcp || icmp || icmp6)\",\n> \"handle_svc_check(inport);\",\n> copp_meter_get(COPP_SVC_MONITOR, od->nbs->copp,\n> meter_groups));\n> @@ -17891,6 +17895,22 @@ ovnnb_db_run(struct northd_input *input_data,\n> smap_replace(&options, \"svc_monitor_mac\", svc_monitor_mac);\n> }\n> \n> + const char *monitor_ip4 = smap_get(&nb->options, \"svc_monitor_ip4\");\n> + if (monitor_ip4) {\n> + struct sockaddr_storage svc_mon_src_addr;\n> + if (inet_parse_address(monitor_ip4, &svc_mon_src_addr)) {\n> + struct ds src_ip_s = DS_EMPTY_INITIALIZER;\n> + ss_format_address_nobracks(&svc_mon_src_addr, &src_ip_s);\n> + svc_monitor_ip4 = ds_steal_cstr(&src_ip_s);\n> + } else {\n> + free(svc_monitor_ip4);\n> + svc_monitor_ip4 = NULL;\n> + }\n> + } else {\n> + free(svc_monitor_ip4);\n> + svc_monitor_ip4 = NULL;\n> + }\n> +\n> char *max_tunid = xasprintf(\"%d\",\n> get_ovn_max_dp_key_local(input_data->sbrec_chassis_table));\n> smap_replace(&options, \"max_tunid\", max_tunid);\n> @@ -18326,3 +18346,9 @@ northd_get_datapath_for_port(const struct hmap *ls_ports,\n> \n> return op ? op->od : NULL;\n> }\n> +\n> +const char *\n> +northd_get_svc_monitor_ip4(void)\n> +{\n> + return svc_monitor_ip4;\n> +}\n> diff --git a/northd/northd.h b/northd/northd.h\n> index 5be7b5384..a69b96bda 100644\n> --- a/northd/northd.h\n> +++ b/northd/northd.h\n> @@ -374,4 +374,5 @@ bool check_sb_lb_duplicates(const struct sbrec_load_balancer_table *);\n> void sync_pbs(struct ovsdb_idl_txn *, struct hmap *ls_ports);\n> bool sync_pbs_for_northd_ls_changes(struct tracked_ls_changes *);\n> \n> +const char *northd_get_svc_monitor_ip4(void);\n> #endif /* NORTHD_H */\n> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml\n> index 98cf7adb4..c121fbb4c 100644\n> --- a/northd/ovn-northd.8.xml\n> +++ b/northd/ovn-northd.8.xml\n> @@ -448,11 +448,14 @@\n> \n>

\n> This table also has a priority-110 flow with the match\n> - eth.dst == E for all logical switch\n> - datapaths to move traffic to the next table. Where E\n> - is the service monitor mac defined in the\n> + eth.dst == E || ip4.dst == I for all\n> + logical switch datapaths to move traffic to the next table. Where\n> + E is the service monitor mac defined in the\n> db=\"OVN_Northbound\"/> column of + db=\"OVN_Northbound\"/> table and I is the service monitor\n> + IP defined in the + db=\"OVN_Northbound\"/> column of db=\"OVN_Northbound\"/> table.\n>

\n> \n> @@ -515,11 +518,14 @@\n> \n>

\n> This table also has a priority-110 flow with the match\n> - eth.dst == E for all logical switch\n> - datapaths to move traffic to the next table. Where E\n> - is the service monitor mac defined in the\n> + eth.dst == E || ip4.dst == I for all\n> + logical switch datapaths to move traffic to the next table. Where\n> + E is the service monitor mac defined in the\n> db=\"OVN_Northbound\"/> column of + db=\"OVN_Northbound\"/> table and I is the service monitor\n> + IP defined in the + db=\"OVN_Northbound\"/> column of db=\"OVN_Northbound\"/> table.\n>

\n> \n> @@ -820,12 +826,15 @@\n>
    \n>
  • \n> A priority 34000 logical flow is added for each logical switch datapath\n> - with the match eth.dst = E to allow the service\n> - monitor reply packet destined to ovn-controller\n> - that sets the allow bit, where E is the\n> - service monitor mac defined in the\n> + with the match eth.dst = E || ip4.dst == I\n> + to allow the service monitor reply packet destined to\n> + ovn-controller that sets the allow bit, where E\n> + is the service monitor mac defined in the\n> db=\"OVN_Northbound\"/> column of + db=\"OVN_Northbound\"/> table and I is the service monitor IP\n> + defined in the + db=\"OVN_Northbound\"/> column of db=\"OVN_Northbound\"/> table.\n>
    • \n>
\n> @@ -1883,11 +1892,16 @@ output;\n>
    \n>
  • \n> A priority-110 flow with the match\n> - eth.src == E for all logical switch\n> - datapaths and applies the action handle_svc_check(inport).\n> - Where E is the service monitor mac defined in the\n> + eth.src == E || ip4.dst == I for\n> + all logical switch datapaths and applies the action\n> + handle_svc_check(inport). Where E is the\n> + service monitor mac defined in the\n> db=\"OVN_Northbound\"/> column of + db=\"OVN_Northbound\"/> table and I is the\n> + service monitor IP defined in the\n> + + db=\"OVN_Northbound\"/> column of db=\"OVN_Northbound\"/> table.\n>
    • \n> \n> diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at\n> index 34bd25de7..dcb2e514c 100644\n> --- a/tests/ovn-northd.at\n> +++ b/tests/ovn-northd.at\n> @@ -2611,7 +2611,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e ls_in_acl_hint -e ls_out_acl_hint -e\n> table=8 (ls_in_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)\n> table=8 (ls_in_acl_eval ), priority=1001 , match=(reg0[[7]] == 1 && (ip)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n> table=8 (ls_in_acl_eval ), priority=1001 , match=(reg0[[8]] == 1 && (ip)), action=(reg8[[16]] = 1; next;)\n> - table=8 (ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=8 (ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=8 (ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=8 (ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=8 (ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -4318,7 +4318,7 @@ check_stateful_flows() {\n> AT_CHECK([grep \"ls_in_pre_lb\" sw0flows | sort | sed 's/table=./table=?/'], [0], [dnl\n> table=? (ls_in_pre_lb ), priority=0 , match=(1), action=(next;)\n> table=? (ls_in_pre_lb ), priority=100 , match=(ip), action=(reg0[[2]] = 1; next;)\n> - table=? (ls_in_pre_lb ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=? (ls_in_pre_lb ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(eth.mcast), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(ip && inport == \"sw0-lr0\"), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;)\n> @@ -4388,7 +4388,7 @@ AT_CAPTURE_FILE([sw0flows])\n> \n> AT_CHECK([grep \"ls_in_pre_lb\" sw0flows | sort | sed 's/table=./table=?/'], [0], [dnl\n> table=? (ls_in_pre_lb ), priority=0 , match=(1), action=(next;)\n> - table=? (ls_in_pre_lb ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=? (ls_in_pre_lb ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(eth.mcast), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(ip && inport == \"sw0-lr0\"), action=(next;)\n> table=? (ls_in_pre_lb ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2), action=(next;)\n> @@ -5079,7 +5079,7 @@ check ovn-nbctl --wait=sb sync\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5091,7 +5091,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort],\n> ovn-sbctl lflow-list ls2 > ls2_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5111,7 +5111,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat 20.0.0.200 192.168.2.200/30\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5125,7 +5125,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort],\n> ovn-sbctl lflow-list ls2 > ls2_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5147,7 +5147,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat 40.0.0.200 192.168.2.148/30\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5163,7 +5163,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort],\n> ovn-sbctl lflow-list ls2 > ls2_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5184,7 +5184,7 @@ ovn-nbctl --wait=sb lr-lb-add ro1 lb1\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5204,7 +5204,7 @@ ovn-nbctl --wait=sb lb-add lb1 192.168.4.100:80 10.0.0.10:80\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -5230,7 +5230,7 @@ ovn-nbctl --wait=sb lrp-set-gateway-chassis ro1-ls1 chassis-1 30\n> ovn-sbctl lflow-list ls1 > ls1_lflows\n> AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed 's/table=../table=??/' | sort], [0], [dnl\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -7172,7 +7172,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \"ls_in_acl_hint\" lsflows | sed 's/table=.\n> table=??(ls_in_acl_eval ), priority=2003 , match=(reg0[[8]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=2004 , match=(reg0[[10]] == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; ct_commit { ct_mark.blocked = 1; }; next;)\n> table=??(ls_in_acl_eval ), priority=2004 , match=(reg0[[9]] == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -7227,7 +7227,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \"ls_in_acl_hint\" lsflows | sed 's/table=.\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && !ct.est), action=(reg0[[1]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -7282,7 +7282,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \"ls_in_acl_hint\" lsflows | sed 's/table=.\n> table=??(ls_in_acl_eval ), priority=2002 , match=(reg0[[8]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=2003 , match=(reg0[[7]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=2003 , match=(reg0[[8]] == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -7573,7 +7573,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_acl_hint ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(next;)\n> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_out_acl_eval ), priority=65535, match=(1), action=(next;)\n> @@ -7598,7 +7598,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_acl_hint ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(next;)\n> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_out_acl_eval ), priority=65535, match=(1), action=(next;)\n> @@ -7623,7 +7623,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_acl_hint ), priority=65535, match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(next;)\n> table=??(ls_out_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_out_acl_eval ), priority=65535, match=(1), action=(next;)\n> @@ -7656,11 +7656,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7693,11 +7693,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7730,11 +7730,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7771,7 +7771,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=1001 , match=(reg0[[7]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=1001 , match=(reg0[[8]] == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -7786,7 +7786,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_hint ), priority=7 , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7840,11 +7840,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7877,11 +7877,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7914,11 +7914,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -7955,7 +7955,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -7970,7 +7970,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_hint ), priority=7 , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -8023,11 +8023,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -8060,11 +8060,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -8097,11 +8097,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_after_lb_eval), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(nd || nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_hint ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[16]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n> table=??(ls_out_acl_action ), priority=1000 , match=(reg8[[17]] == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -8137,7 +8137,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_eval ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && !ct.est), action=(next;)\n> table=??(ls_in_acl_eval ), priority=1 , match=(ip && ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = 1; next;)\n> - table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n> + table=??(ls_in_acl_eval ), priority=34000, match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(!ct.est && ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.est && !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = 1; next;)\n> table=??(ls_in_acl_eval ), priority=65532, match=(ct.inv || (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; next;)\n> @@ -8152,7 +8152,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \"ls_.*_acl\" | sed 's/table=../table=??/\n> table=??(ls_in_acl_hint ), priority=7 , match=(ct.new && !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n> table=??(ls_in_pre_acl ), priority=0 , match=(1), action=(next;)\n> table=??(ls_in_pre_acl ), priority=100 , match=(ip), action=(reg0[[0]] = 1; next;)\n> - table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac), action=(next;)\n> + table=??(ls_in_pre_acl ), priority=110 , match=(eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(eth.mcast), action=(next;)\n> table=??(ls_in_pre_acl ), priority=110 , match=(nd || nd_rs || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == 547)), action=(next;)\n> table=??(ls_out_acl_action ), priority=0 , match=(1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n> @@ -8324,7 +8324,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> table=??(ls_in_l2_unknown ), priority=0 , match=(1), action=(output;)\n> table=??(ls_in_l2_unknown ), priority=50 , match=(outport == \"none\"), action=(drop;)\n> @@ -8349,7 +8349,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -8375,7 +8375,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -8402,7 +8402,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=0 , match=(1), action=(output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -8430,7 +8430,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == \"localnetport\" && inport == \"sw0p2\"), action=(set_queue(10); output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)\n> @@ -8462,7 +8462,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n> table=??(ls_out_apply_port_sec), priority=110 , match=(outport == \"localnetport\" && inport == \"sw0p2\"), action=(set_queue(10); output;)\n> table=??(ls_out_apply_port_sec), priority=50 , match=(reg0[[15]] == 1), action=(drop;)\n> table=??(ls_in_l2_lkup ), priority=0 , match=(1), action=(outport = get_fdb(eth.dst); next;)\n> - table=??(ls_in_l2_lkup ), priority=110 , match=(eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> + table=??(ls_in_l2_lkup ), priority=110 , match=((eth.dst == $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || icmp6)), action=(handle_svc_check(inport);)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n> table=??(ls_in_l2_lkup ), priority=50 , match=(eth.dst == 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n> table=??(ls_in_l2_lkup ), priority=70 , match=(eth.mcast), action=(outport = \"_MC_flood\"; output;)","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=dTuCYuGF;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp3.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key)\n header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=dTuCYuGF"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4TR19f6pMCz23gH\n\tfor ; Fri, 2 Feb 2024 14:15:17 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 3E27D6FA6A;\n\tFri, 2 Feb 2024 03:15:14 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n\tby localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id rmVEqT7gkH3y; Fri, 2 Feb 2024 03:15:11 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56])\n\tby smtp3.osuosl.org (Postfix) with ESMTPS id 9A0576FA92;\n\tFri, 2 Feb 2024 03:15:10 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 669D1C0077;\n\tFri, 2 Feb 2024 03:15:10 +0000 (UTC)","from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n by lists.linuxfoundation.org (Postfix) with ESMTP id AC0F1C0037\n for ; Fri, 2 Feb 2024 03:15:09 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp3.osuosl.org (Postfix) with ESMTP id 734806FA92\n for ; Fri, 2 Feb 2024 03:15:09 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n with ESMTP id tZLbFVfhJRek for ;\n Fri, 2 Feb 2024 03:15:06 +0000 (UTC)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.133.124])\n by smtp3.osuosl.org (Postfix) with ESMTPS id 79AED6FA6A\n for ; Fri, 2 Feb 2024 03:15:06 +0000 (UTC)","from mail-qv1-f70.google.com (mail-qv1-f70.google.com\n [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-466-gtPQlR7wOAeYZI_m7-jVyA-1; Thu, 01 Feb 2024 22:15:02 -0500","by mail-qv1-f70.google.com with SMTP id\n 6a1803df08f44-68c52361422so20032996d6.3\n for ; Thu, 01 Feb 2024 19:15:02 -0800 (PST)","from [192.168.0.209] (074-130-022-038.res.spectrum.com.\n [74.130.22.38]) by smtp.gmail.com with ESMTPSA id\n d1-20020a0ce441000000b0068c4b445991sm388851qvm.67.2024.02.01.19.14.57\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Thu, 01 Feb 2024 19:14:58 -0800 (PST)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org 3E27D6FA6A","OpenDKIM Filter v2.11.0 smtp3.osuosl.org 9A0576FA92","OpenDKIM Filter v2.11.0 smtp3.osuosl.org 734806FA92","OpenDKIM Filter v2.11.0 smtp3.osuosl.org 79AED6FA6A"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1706843705;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=uIXeIw2v+SXoYLb/+t8k584JDee+0eguy4R2MmKI260=;\n b=dTuCYuGFTE/eWef57z7+7fYTIRYXiY+rqrqKquPFf+wKtXclgaH9+Y2W30R5c22YQwG5oM\n 4C/1paw5r/tVlPxrtzNOtZiiscGyChRcQynVp6HuxLNuObeIk58yg6jREdkzRNOq36HkkD\n ATRlce2Ue1ihLdmy8SijRRw+GeTiA7Y=","X-MC-Unique":"gtPQlR7wOAeYZI_m7-jVyA-1","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1706843701; x=1707448501;\n h=content-transfer-encoding:in-reply-to:from:references:to\n :content-language:subject:user-agent:mime-version:date:message-id\n :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=uIXeIw2v+SXoYLb/+t8k584JDee+0eguy4R2MmKI260=;\n b=b2jdu+7VRSawXLcz5YEFUESUQcDI8shs5IbBhCsa33teEDTCO2SuJVvxdzotMAqUgq\n NvHg6mDDxkWGMWhc/V1DDsSO1IfL8y5sfhIk9WPK8p3c6W9uYI0zuX4/PjglIN6xsv+e\n bAAxnCBUmj8W0RUzgF8h0h5wvt9KQI8Z/T3pa8vLlsjdU/dIpkl4nKsKFPaiayT+JSsk\n 275nYMrlb4mcibC7Jkh2GadwmEkw5FpRgm4OJnl6KcdmRalM1SLDgOIki/3DPXThEkkn\n AtZLgvCYoz6I/8We6P+dBziIkJpWqRtFxxExKWhmYE6qmepWagrYH+FIpDIgP7LVTOM2\n RZRA==","X-Gm-Message-State":"AOJu0YwVdqx6yMJQFm/lMkEMI+rSGpk4qdfwYvc5Ddpq5bQH4ugdvqfL\n 1tJpAKgxitfbJPxchj/TWQu6+J/jbrPMEo5B1VF/Cx3Os2R0plz+dMUqI150XaonjCStgpFfTVF\n YUUC7/UR51Jqxt7dywJcXjiVhUcTUPxH+NlAXSg0AEwFcazFwI8P5nr8aWQ==","X-Received":["by 2002:a05:6214:c28:b0:685:c6ad:5232 with SMTP id\n a8-20020a0562140c2800b00685c6ad5232mr8006140qvd.24.1706843700345;\n Thu, 01 Feb 2024 19:15:00 -0800 (PST)","by 2002:a05:6214:c28:b0:685:c6ad:5232 with SMTP id\n a8-20020a0562140c2800b00685c6ad5232mr8006082qvd.24.1706843699026;\n Thu, 01 Feb 2024 19:14:59 -0800 (PST)"],"X-Google-Smtp-Source":"\n AGHT+IGP9cqvOJ42NA2w1Owuu7w5kBIBnLNYau7CgrHW3bPnlIWOFdwFzIYwtuxA7N7yaZZH9WEnig==","X-Forwarded-Encrypted":"i=0;\n AJvYcCVcg1FVsfJHVb7a1IoSNJCwtiItgZ/fV7d2d5aMe+d+K4VxnYTLgOIxkdBJbVaN6tw7EMqMsqiQk8zydGlk2y8atKil","Message-ID":"","Date":"Thu, 1 Feb 2024 22:14:56 -0500","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","To":"Priyankar Jain , dev@openvswitch.org","References":"<20240108130004.51995-1-priyankar.jain@nutanix.com>","From":"Mark Michelson ","In-Reply-To":"<20240108130004.51995-1-priyankar.jain@nutanix.com>","X-Mimecast-Spam-Score":"0","X-Mimecast-Originator":"redhat.com","Content-Language":"en-US","Subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n NB_Global options.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.15","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "}},{"id":3259253,"web_url":"http://patchwork.ozlabs.org/comment/3259253/","msgid":"<95a8b6a9-a1fd-46e7-abd5-b4daa25cae59@nutanix.com>","list_archive_url":null,"date":"2024-02-06T04:29:10","subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n NB_Global options.","submitter":{"id":80621,"url":"http://patchwork.ozlabs.org/api/people/80621/","name":"Priyankar Jain","email":"priyankar.jain@nutanix.com"},"content":"Hi,\n\nOn 02/02/24 8:44 am, Mark Michelson wrote:\n> Hi Priyankar,\n>\n> I'm not sure I understand the purpose of this patch. Even without this \n> patch, you could configure whatever IP address you want in the \n> ip_port_mappings as the source address for the health checks. I don't \n> see anything in the code that restricts the IP to be within the subnet \n> of the backend IP address. And even if there is such a restriction, I \n> don't see anything in this patch that lifts that restriction.\n\nThere is no restriction from any OVN configuration point of view. But \nconsider the scenario where the source IP in the ip_port_mappings \nbelongs to the subnet outside of the backend VM. In that case, the \nbackend VM will receive the health probe correctly, but when it tries to \nsend the reply back to the probe, the VM tries to send packet to the \nrouter GW instead (since IP belongs to diff subnet than that of VM.). \nHence, the reverse direction packet never reaches the OVN controller \nbecause dst-mac is set to the VM subnet's GW.\n\nSample tcpdump on the Backend VM interface:\n\nsource ip:169.254.1.21, svc_monitor_mac = 52:89:2d:d7:12:d0, backend VM \nmac: 50:6b:8d:15:c9:0e, backend VM IP: 50.0.0.93\n\n  04:23:18.080058 52:89:2d:d7:12:d0 > 50:6b:8d:15:c9:0e, ethertype IPv4 \n(0x0800), length 54: (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto \nTCP (6), length 40)\n     169.254.1.21.54010 > 50.0.0.93.80: Flags [S], cksum 0xa921 \n(correct), seq 1988485367, win 65160, length 0\n04:23:18.080512 50:6b:8d:15:c9:0e > e0:19:95:6d:37:58, ethertype IPv4 \n(0x0800), length 58: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto \nTCP (6), length 44)\n     50.0.0.93.80 > 169.254.1.21.54010: Flags [S.], cksum 0xdd8e \n(incorrect -> 0x7c1d), seq 2754347589, ack 1988485368, win 28040, \noptions [mss 1402], length 0\n\nNotice in the reply from the VM, the destination MAC is set to the \ndefault GW's MAC. Hence, it is not delivered to the ovn-controller.\n\nWith my patch, the user can set an IP address for the service monitor in \nNB_GLOBAL and use the same IP address in the ip-port-mappings. This way \neven if the dst mac is GW, as long as it is destined to svc monitor IP, \nit will be delivered to OVN controller.\n\n>\n> The extra matches added in this patch (eth.dst == $svc_monitor_mac || \n> ip4.dst == $svc_monitor_ip4) don't make much sense to me either. When \n> OVN sends a health check, the reply from the backend will have eth.dst \n> set to the service monitor MAC address. Since the existing matches do \n> not care what the destination IPv4 address is, the existing match \n> should work fine. If there was something in the code that was dropping \n> packets addressed to IP addresses outside the subnet of the configured \n> load balancer backends, this patch doesn't appear to be doing anything \n> to prevent such droppage.\n>\nWe didn't notice this behaviour. The VM was sending the reply to the \ndefault gateway mac address.\n> And finally, if I'm mistaken about my above two points, then my final \n> problem with this patch is that it only adds support for IPv4. I \n> noticed that in the documentation for the Service_Monitor table in the \n> southbound database, it claims that \"Service monitoring for IPv6 \n> services is not supported.\" And the \"src_ip\" field is documented as \n> \"Source IPv4 address to use in the service monitor packet.\" \n> Unfortunately, these are inaccurate. IPv6 service monitoring was added \n> as a feature about 3 months after the initial IPv4 service monitoring \n> was added. Unfortunately, it looks as though we did not update the \n> documentation, and we need to get this fixed. However, the northbound \n> load balancer health check documentation makes it clear that IPv6 is \n> supported, and the code also has support for IPv6 in it. So if I'm \n> incorrect in the first two paragraphs and this option is really \n> needed, then it needs to support IPv6 as well.\n\nohh my bad. I forgot about IPv6. I'll add for it as well.\n\nThanks,\nPriyankar\n\n>\n> Thanks,\n> Mark Michelson\n>\n> On 1/8/24 08:00, Priyankar Jain wrote:\n>> This commit adds a new optional svc_monitor_ipv4 config in the NB_Global\n>> options column. This IP address can be used to send the packets to the\n>> OVN controller bypassing most of the logical switches pipelines.\n>>\n>> Usage: Currently Load balancer health check requires a source IP address\n>> to be allocated from the subnets where backends are present.\n>> This change removes that requirement and instead user can give one IP\n>> address for the system and set it in NB_Global:options:svc_monitor_ipv4.\n>> While configuring the health check for the load balancer user can\n>> provide this same IP while specifying the ip-port mappings.\n>>\n>> Signed-off-by: Priyankar Jain \n>> ---\n>>\n>> Changes since v1:\n>>   - Fixed one testcase in ovn-northd.at\n>>\n>> ---\n>>   northd/en-sync-sb.c     | 10 +++++\n>>   northd/northd.c         | 34 +++++++++++++--\n>>   northd/northd.h         |  1 +\n>>   northd/ovn-northd.8.xml | 40 +++++++++++------\n>>   tests/ovn-northd.at     | 96 ++++++++++++++++++++---------------------\n>>   5 files changed, 116 insertions(+), 65 deletions(-)\n>>\n>> diff --git a/northd/en-sync-sb.c b/northd/en-sync-sb.c\n>> index 2ec3bf54f..95e9ead29 100644\n>> --- a/northd/en-sync-sb.c\n>> +++ b/northd/en-sync-sb.c\n>> @@ -372,6 +372,16 @@ sync_addr_sets(struct ovsdb_idl_txn *ovnsb_txn,\n>>       sync_addr_set(ovnsb_txn, \"svc_monitor_mac\", &svc, \n>> &sb_address_sets);\n>>       sorted_array_destroy(&svc);\n>>   +    /* Service monitor IP. */\n>> +    const char *svc_monitor_ip4 = northd_get_svc_monitor_ip4();\n>> +    int num_addr = 0; /* Create empty address-set by default */\n>> +    if (svc_monitor_ip4) {\n>> +        num_addr = 1;\n>> +    }\n>> +    struct sorted_array ip_svc = sorted_array_create(&svc_monitor_ip4,\n>> +                                                     num_addr, false);\n>> +    sync_addr_set(ovnsb_txn, \"svc_monitor_ip4\", &ip_svc, \n>> &sb_address_sets);\n>> +\n>>       /* sync port group generated address sets first */\n>>       const struct nbrec_port_group *nb_port_group;\n>>       NBREC_PORT_GROUP_TABLE_FOR_EACH (nb_port_group,\n>> diff --git a/northd/northd.c b/northd/northd.c\n>> index db3cd272e..f6d35143a 100644\n>> --- a/northd/northd.c\n>> +++ b/northd/northd.c\n>> @@ -82,6 +82,7 @@ static bool use_common_zone = false;\n>>   static char svc_monitor_mac[ETH_ADDR_STRLEN + 1];\n>>   static struct eth_addr svc_monitor_mac_ea;\n>>   +static char *svc_monitor_ip4 = NULL;\n>>   /* If this option is 'true' northd will make use of ct.inv match \n>> fields.\n>>    * Otherwise, it will avoid using it.  The default is true. */\n>>   static bool use_ct_inv_match = true;\n>> @@ -7197,7 +7198,8 @@ build_pre_acls(struct ovn_datapath *od,\n>>       ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 0, \"1\", \"next;\");\n>>         ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_ACL, 110,\n>> -                  \"eth.dst == $svc_monitor_mac\", \"next;\");\n>> +                  \"eth.dst == $svc_monitor_mac || ip4.dst == \n>> $svc_monitor_ip4\",\n>> +                  \"next;\");\n>>         ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_ACL, 110,\n>>                     \"eth.src == $svc_monitor_mac\", \"next;\");\n>> @@ -7370,7 +7372,8 @@ build_pre_lb(struct ovn_datapath *od, const \n>> struct shash *meter_groups,\n>>         /* Do not send service monitor packets to conntrack. */\n>>       ovn_lflow_add(lflows, od, S_SWITCH_IN_PRE_LB, 110,\n>> -                  \"eth.dst == $svc_monitor_mac\", \"next;\");\n>> +                  \"eth.dst == $svc_monitor_mac || ip4.dst == \n>> $svc_monitor_ip4\",\n>> +                  \"next;\");\n>>       ovn_lflow_add(lflows, od, S_SWITCH_OUT_PRE_LB, 110,\n>>                     \"eth.src == $svc_monitor_mac\", \"next;\");\n>>   @@ -8238,7 +8241,7 @@ build_acls(struct ovn_datapath *od, const \n>> struct chassis_features *features,\n>>           /* Add a 34000 priority flow to advance the service monitor \n>> reply\n>>           * packets to skip applying ingress ACLs. */\n>>           ovn_lflow_add(lflows, od, S_SWITCH_IN_ACL_EVAL, 34000,\n>> -                    \"eth.dst == $svc_monitor_mac\",\n>> +                    \"eth.dst == $svc_monitor_mac || ip4.dst == \n>> $svc_monitor_ip4\",\n>>                       REGBIT_ACL_VERDICT_ALLOW\" = 1; next;\");\n>>             /* Add a 34000 priority flow to advance the service \n>> monitor packets\n>> @@ -10325,7 +10328,8 @@ \n>> build_lswitch_destination_lookup_bmcast(struct ovn_datapath *od,\n>>       ovs_assert(od->nbs);\n>>         ovn_lflow_metered(lflows, od, S_SWITCH_IN_L2_LKUP, 110,\n>> -                      \"eth.dst == $svc_monitor_mac && (tcp || icmp \n>> || icmp6)\",\n>> +                      \"(eth.dst == $svc_monitor_mac || ip4.dst == \n>> $svc_monitor_ip4)\"\n>> +                      \" && (tcp || icmp || icmp6)\",\n>>                         \"handle_svc_check(inport);\",\n>>                         copp_meter_get(COPP_SVC_MONITOR, od->nbs->copp,\n>>                                        meter_groups));\n>> @@ -17891,6 +17895,22 @@ ovnnb_db_run(struct northd_input *input_data,\n>>           smap_replace(&options, \"svc_monitor_mac\", svc_monitor_mac);\n>>       }\n>>   +    const char *monitor_ip4 = smap_get(&nb->options, \n>> \"svc_monitor_ip4\");\n>> +    if (monitor_ip4) {\n>> +        struct sockaddr_storage svc_mon_src_addr;\n>> +        if (inet_parse_address(monitor_ip4, &svc_mon_src_addr)) {\n>> +            struct ds src_ip_s = DS_EMPTY_INITIALIZER;\n>> +            ss_format_address_nobracks(&svc_mon_src_addr, &src_ip_s);\n>> +            svc_monitor_ip4 = ds_steal_cstr(&src_ip_s);\n>> +        } else {\n>> +            free(svc_monitor_ip4);\n>> +            svc_monitor_ip4 = NULL;\n>> +        }\n>> +    } else {\n>> +        free(svc_monitor_ip4);\n>> +        svc_monitor_ip4 = NULL;\n>> +    }\n>> +\n>>       char *max_tunid = xasprintf(\"%d\",\n>> get_ovn_max_dp_key_local(input_data->sbrec_chassis_table));\n>>       smap_replace(&options, \"max_tunid\", max_tunid);\n>> @@ -18326,3 +18346,9 @@ northd_get_datapath_for_port(const struct \n>> hmap *ls_ports,\n>>         return op ? op->od : NULL;\n>>   }\n>> +\n>> +const char *\n>> +northd_get_svc_monitor_ip4(void)\n>> +{\n>> +    return svc_monitor_ip4;\n>> +}\n>> diff --git a/northd/northd.h b/northd/northd.h\n>> index 5be7b5384..a69b96bda 100644\n>> --- a/northd/northd.h\n>> +++ b/northd/northd.h\n>> @@ -374,4 +374,5 @@ bool check_sb_lb_duplicates(const struct \n>> sbrec_load_balancer_table *);\n>>   void sync_pbs(struct ovsdb_idl_txn *, struct hmap *ls_ports);\n>>   bool sync_pbs_for_northd_ls_changes(struct tracked_ls_changes *);\n>>   +const char *northd_get_svc_monitor_ip4(void);\n>>   #endif /* NORTHD_H */\n>> diff --git a/northd/ovn-northd.8.xml b/northd/ovn-northd.8.xml\n>> index 98cf7adb4..c121fbb4c 100644\n>> --- a/northd/ovn-northd.8.xml\n>> +++ b/northd/ovn-northd.8.xml\n>> @@ -448,11 +448,14 @@\n>>        

    \n>>         This table also has a priority-110 flow with the match\n>> -      eth.dst == E for all logical switch\n>> -      datapaths to move traffic to the next table. Where E\n>> -      is the service monitor mac defined in the\n>> +      eth.dst == E || ip4.dst == \n>> I for all\n>> +      logical switch datapaths to move traffic to the next table. Where\n>> +      E is the service monitor mac defined in the\n>>         >         db=\"OVN_Northbound\"/> column of > +      db=\"OVN_Northbound\"/> table and I is the service \n>> monitor\n>> +      IP defined in the > table=\"NB_Global\"\n>> +      db=\"OVN_Northbound\"/> column of >         db=\"OVN_Northbound\"/> table.\n>>      

    \n>>   @@ -515,11 +518,14 @@\n>>        

    \n>>         This table also has a priority-110 flow with the match\n>> -      eth.dst == E for all logical switch\n>> -      datapaths to move traffic to the next table. Where E\n>> -      is the service monitor mac defined in the\n>> +      eth.dst == E || ip4.dst == \n>> I for all\n>> +      logical switch datapaths to move traffic to the next table. Where\n>> +      E is the service monitor mac defined in the\n>>         >         db=\"OVN_Northbound\"/> column of > +      db=\"OVN_Northbound\"/> table and I is the service \n>> monitor\n>> +      IP defined in the > table=\"NB_Global\"\n>> +      db=\"OVN_Northbound\"/> column of >         db=\"OVN_Northbound\"/> table.\n>>      

    \n>>   @@ -820,12 +826,15 @@\n>>      
      \n>>        
    • \n>>           A priority 34000 logical flow is added for each logical \n>> switch datapath\n>> -        with the match eth.dst = E to allow \n>> the service\n>> -        monitor reply packet destined to ovn-controller\n>> -        that sets the allow bit, where E is the\n>> -        service monitor mac defined in the\n>> +        with the match eth.dst = E || ip4.dst == \n>> I\n>> +        to allow the service monitor reply packet destined to\n>> +        ovn-controller that sets the allow bit, where \n>> E\n>> +        is the service monitor mac defined in the\n>>           >           db=\"OVN_Northbound\"/> column of > +        db=\"OVN_Northbound\"/> table and I is the service \n>> monitor IP\n>> +        defined in the > table=\"NB_Global\"\n>> +        db=\"OVN_Northbound\"/> column of >           db=\"OVN_Northbound\"/> table.\n>>        
      • \n>>      
    \n>> @@ -1883,11 +1892,16 @@ output;\n>>      
      \n>>        
    • \n>>           A priority-110 flow with the match\n>> -        eth.src == E for all logical switch\n>> -        datapaths and applies the action \n>> handle_svc_check(inport).\n>> -        Where E is the service monitor mac defined in the\n>> +        eth.src == E || ip4.dst == \n>> I for\n>> +        all logical switch datapaths and applies the action\n>> +        handle_svc_check(inport). Where E is \n>> the\n>> +        service monitor mac defined in the\n>>           >           db=\"OVN_Northbound\"/> column of > +        db=\"OVN_Northbound\"/> table and I is the\n>> +        service monitor IP defined in the\n>> +        > +        db=\"OVN_Northbound\"/> column of >           db=\"OVN_Northbound\"/> table.\n>>        
      • \n>>   diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at\n>> index 34bd25de7..dcb2e514c 100644\n>> --- a/tests/ovn-northd.at\n>> +++ b/tests/ovn-northd.at\n>> @@ -2611,7 +2611,7 @@ AT_CHECK([ovn-sbctl lflow-list ls | grep -e \n>> ls_in_acl_hint -e ls_out_acl_hint -e\n>>     table=8 (ls_in_acl_eval     ), priority=1    , match=(ip && \n>> ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=8 (ls_in_acl_eval     ), priority=1001 , match=(reg0[[7]] \n>> == 1 && (ip)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n>>     table=8 (ls_in_acl_eval     ), priority=1001 , match=(reg0[[8]] \n>> == 1 && (ip)), action=(reg8[[16]] = 1; next;)\n>> -  table=8 (ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=8 (ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=8 (ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=8 (ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=8 (ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -4318,7 +4318,7 @@ check_stateful_flows() {\n>>       AT_CHECK([grep \"ls_in_pre_lb\" sw0flows | sort | sed \n>> 's/table=./table=?/'], [0], [dnl\n>>     table=? (ls_in_pre_lb       ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=100  , match=(ip), \n>> action=(reg0[[2]] = 1; next;)\n>> -  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(eth.mcast), \n>> action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(ip && \n>> inport == \"sw0-lr0\"), action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(nd || nd_rs \n>> || nd_ra || mldv1 || mldv2), action=(next;)\n>> @@ -4388,7 +4388,7 @@ AT_CAPTURE_FILE([sw0flows])\n>>     AT_CHECK([grep \"ls_in_pre_lb\" sw0flows | sort | sed \n>> 's/table=./table=?/'], [0], [dnl\n>>     table=? (ls_in_pre_lb       ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=? (ls_in_pre_lb       ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(eth.mcast), \n>> action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(ip && \n>> inport == \"sw0-lr0\"), action=(next;)\n>>     table=? (ls_in_pre_lb       ), priority=110  , match=(nd || nd_rs \n>> || nd_ra || mldv1 || mldv2), action=(next;)\n>> @@ -5079,7 +5079,7 @@ check ovn-nbctl --wait=sb sync\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5091,7 +5091,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort],\n>>   ovn-sbctl lflow-list ls2 > ls2_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5111,7 +5111,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat \n>> 20.0.0.200 192.168.2.200/30\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5125,7 +5125,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort],\n>>   ovn-sbctl lflow-list ls2 > ls2_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5147,7 +5147,7 @@ check ovn-nbctl --wait=sb lr-nat-add ro2 snat \n>> 40.0.0.200 192.168.2.148/30\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5163,7 +5163,7 @@ AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort],\n>>   ovn-sbctl lflow-list ls2 > ls2_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls2_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:01), action=(outport = \"ls2-ro2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:02:02), action=(outport = \"vm2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5184,7 +5184,7 @@ ovn-nbctl --wait=sb lr-lb-add ro1 lb1\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5204,7 +5204,7 @@ ovn-nbctl --wait=sb lb-add lb1 192.168.4.100:80 \n>> 10.0.0.10:80\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -5230,7 +5230,7 @@ ovn-nbctl --wait=sb lrp-set-gateway-chassis \n>> ro1-ls1 chassis-1 30\n>>   ovn-sbctl lflow-list ls1 > ls1_lflows\n>>   AT_CHECK([grep \"ls_in_l2_lkup\" ls1_lflows | sed \n>> 's/table=../table=??/' | sort], [0], [dnl\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:01), action=(outport = \"ls1-ro1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:01:02), action=(outport = \"vm1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -7172,7 +7172,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \n>> \"ls_in_acl_hint\" lsflows | sed 's/table=.\n>>     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[8]] \n>> == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=2004 , match=(reg0[[10]] \n>> == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; \n>> ct_commit { ct_mark.blocked = 1; }; next;)\n>>     table=??(ls_in_acl_eval     ), priority=2004 , match=(reg0[[9]] \n>> == 1 && (ip4 && ip4.dst == 10.0.0.2)), action=(reg8[[17]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -7227,7 +7227,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \n>> \"ls_in_acl_hint\" lsflows | sed 's/table=.\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> !ct.est), action=(reg0[[1]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = \n>> 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -7282,7 +7282,7 @@ AT_CHECK([grep -e \"ls_in_acl.*eval\" -e \n>> \"ls_in_acl_hint\" lsflows | sed 's/table=.\n>>     table=??(ls_in_acl_eval     ), priority=2002 , match=(reg0[[8]] \n>> == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[7]] \n>> == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=2003 , match=(reg0[[8]] \n>> == 1 && (ip4 && icmp)), action=(reg8[[16]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -7573,7 +7573,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_hint     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_out_acl_eval    ), priority=65535, match=(1), \n>> action=(next;)\n>> @@ -7598,7 +7598,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_hint     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_out_acl_eval    ), priority=65535, match=(1), \n>> action=(next;)\n>> @@ -7623,7 +7623,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_hint     ), priority=65535, match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_out_acl_eval    ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_out_acl_eval    ), priority=65535, match=(1), \n>> action=(next;)\n>> @@ -7656,11 +7656,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7693,11 +7693,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7730,11 +7730,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7771,7 +7771,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=1001 , match=(reg0[[7]] \n>> == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; reg0[[1]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=1001 , match=(reg0[[8]] \n>> == 1 && (ip4 && tcp)), action=(reg8[[16]] = 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -7786,7 +7786,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && \n>> !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), \n>> action=(reg0[[0]] = 1; next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs \n>> || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == \n>> 547)), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>> @@ -7840,11 +7840,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7877,11 +7877,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7914,11 +7914,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=1001 , match=((ip4 && \n>> tcp)), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -7955,7 +7955,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> !ct.est), action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = \n>> 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -7970,7 +7970,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && \n>> !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), \n>> action=(reg0[[0]] = 1; next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs \n>> || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == \n>> 547)), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>> @@ -8023,11 +8023,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -8060,11 +8060,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -8097,11 +8097,11 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_after_lb_eval), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_after_lb_eval), priority=65532, match=(nd || \n>> nd_ra || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(nd || nd_ra \n>> || nd_rs || mldv1 || mldv2), action=(reg8[[16]] = 1; next;)\n>>     table=??(ls_in_acl_hint     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[16]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; next;)\n>>     table=??(ls_out_acl_action  ), priority=1000 , match=(reg8[[17]] \n>> == 1), action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* \n>> drop */)\n>> @@ -8137,7 +8137,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_eval     ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> !ct.est), action=(next;)\n>>     table=??(ls_in_acl_eval     ), priority=1    , match=(ip && \n>> ct.est && ct_mark.blocked == 1), action=(reg0[[1]] = 1; reg8[[16]] = \n>> 1; next;)\n>> -  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac), action=(reg8[[16]] = 1; next;)\n>> +  table=??(ls_in_acl_eval     ), priority=34000, match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(reg8[[16]] \n>> = 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(!ct.est && \n>> ct.rel && !ct.new && !ct.inv && ct_mark.blocked == 0), \n>> action=(reg0[[17]] = 1; reg8[[16]] = 1; ct_commit_nat;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.est && \n>> !ct.rel && !ct.new && !ct.inv && ct.rpl && ct_mark.blocked == 0), \n>> action=(reg0[[9]] = 0; reg0[[10]] = 0; reg0[[17]] = 1; reg8[[16]] = \n>> 1; next;)\n>>     table=??(ls_in_acl_eval     ), priority=65532, match=(ct.inv || \n>> (ct.est && ct.rpl && ct_mark.blocked == 1)), action=(reg8[[17]] = 1; \n>> next;)\n>> @@ -8152,7 +8152,7 @@ AT_CHECK([ovn-sbctl dump-flows | grep -E \n>> \"ls_.*_acl\" | sed 's/table=../table=??/\n>>     table=??(ls_in_acl_hint     ), priority=7    , match=(ct.new && \n>> !ct.est), action=(reg0[[7]] = 1; reg0[[9]] = 1; next;)\n>>     table=??(ls_in_pre_acl      ), priority=0    , match=(1), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=100  , match=(ip), \n>> action=(reg0[[0]] = 1; next;)\n>> -  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac), action=(next;)\n>> +  table=??(ls_in_pre_acl      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4), action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(eth.mcast), \n>> action=(next;)\n>>     table=??(ls_in_pre_acl      ), priority=110  , match=(nd || nd_rs \n>> || nd_ra || mldv1 || mldv2 || (udp && udp.src == 546 && udp.dst == \n>> 547)), action=(next;)\n>>     table=??(ls_out_acl_action  ), priority=0    , match=(1), \n>> action=(reg8[[16]] = 0; reg8[[17]] = 0; reg8[[18]] = 0; /* drop */)\n>> @@ -8324,7 +8324,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=0    , match=(1), \n>> action=(output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>>     table=??(ls_in_l2_unknown   ), priority=0    , match=(1), \n>> action=(output;)\n>>     table=??(ls_in_l2_unknown   ), priority=50   , match=(outport == \n>> \"none\"), action=(drop;)\n>> @@ -8349,7 +8349,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=0    , match=(1), \n>> action=(output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -8375,7 +8375,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=0    , match=(1), \n>> action=(output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -8402,7 +8402,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=0    , match=(1), \n>> action=(output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:01), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -8430,7 +8430,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=110  , match=(outport \n>> == \"localnetport\" && inport == \"sw0p2\"), action=(set_queue(10); output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:01), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>> @@ -8462,7 +8462,7 @@ sort | sed 's/table=../table=??/' ], [0], [dnl\n>>     table=??(ls_out_apply_port_sec), priority=110  , match=(outport \n>> == \"localnetport\" && inport == \"sw0p2\"), action=(set_queue(10); output;)\n>>     table=??(ls_out_apply_port_sec), priority=50   , \n>> match=(reg0[[15]] == 1), action=(drop;)\n>>     table=??(ls_in_l2_lkup      ), priority=0    , match=(1), \n>> action=(outport = get_fdb(eth.dst); next;)\n>> -  table=??(ls_in_l2_lkup      ), priority=110  , match=(eth.dst == \n>> $svc_monitor_mac && (tcp || icmp || icmp6)), \n>> action=(handle_svc_check(inport);)\n>> +  table=??(ls_in_l2_lkup      ), priority=110  , match=((eth.dst == \n>> $svc_monitor_mac || ip4.dst == $svc_monitor_ip4) && (tcp || icmp || \n>> icmp6)), action=(handle_svc_check(inport);)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:01), action=(outport = \"sw0p1\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=50   , match=(eth.dst == \n>> 00:00:00:00:00:02), action=(outport = \"sw0p2\"; output;)\n>>     table=??(ls_in_l2_lkup      ), priority=70   , match=(eth.mcast), \n>> action=(outport = \"_MC_flood\"; output;)\n>","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=nutanix.com header.i=@nutanix.com header.a=rsa-sha256\n header.s=proofpoint20171006 header.b=Bkk5bnzM;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=nutanix.com header.i=@nutanix.com header.a=rsa-sha256\n header.s=selector1 header.b=SzWkedm5;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::133; helo=smtp2.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp2.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=nutanix.com header.i=@nutanix.com header.a=rsa-sha256\n header.s=proofpoint20171006 header.b=Bkk5bnzM;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key,\n unprotected) header.d=nutanix.com header.i=@nutanix.com header.a=rsa-sha256\n header.s=selector1 header.b=SzWkedm5","smtp1.osuosl.org;\n dmarc=pass (p=none dis=none) header.from=nutanix.com","smtp1.osuosl.org;\n dkim=pass (2048-bit key, unprotected) header.d=nutanix.com\n header.i=@nutanix.com header.a=rsa-sha256 header.s=proofpoint20171006\n header.b=Bkk5bnzM; dkim=pass (2048-bit key,\n unprotected) header.d=nutanix.com header.i=@nutanix.com header.a=rsa-sha256\n header.s=selector1 header.b=SzWkedm5"],"Received":["from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4TTVdX3sp8z23gb\n\tfor ; Tue, 6 Feb 2024 15:29:36 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp2.osuosl.org (Postfix) with ESMTP id 6E704402E0;\n\tTue, 6 Feb 2024 04:29:33 +0000 (UTC)","from smtp2.osuosl.org ([127.0.0.1])\n\tby localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id fwfPWRQoiIEC; Tue, 6 Feb 2024 04:29:30 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56])\n\tby smtp2.osuosl.org (Postfix) with ESMTPS id 34F83400CE;\n\tTue, 6 Feb 2024 04:29:29 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 12808C0072;\n\tTue, 6 Feb 2024 04:29:29 +0000 (UTC)","from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 2D1EEC0037\n for ; Tue, 6 Feb 2024 04:29:27 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id 16DF5813E1\n for ; Tue, 6 Feb 2024 04:29:27 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n with ESMTP id 8FX0empb9Zat for ;\n Tue, 6 Feb 2024 04:29:24 +0000 (UTC)","from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com\n [148.163.151.68])\n by smtp1.osuosl.org (Postfix) with ESMTPS id 4A7FF81298\n for ; Tue, 6 Feb 2024 04:29:23 +0000 (UTC)","from pps.filterd (m0127838.ppops.net [127.0.0.1])\n by mx0a-002c1b01.pphosted.com (8.17.1.24/8.17.1.24) with ESMTP id\n 415F5lI1021093; Mon, 5 Feb 2024 20:29:23 -0800","from sa9pr02cu001.outbound.protection.outlook.com\n (mail-southcentralusazlp17011010.outbound.protection.outlook.com\n [40.93.14.10])\n by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 3w1nx0ces5-1\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n Mon, 05 Feb 2024 20:29:22 -0800 (PST)","from PH0PR02MB7496.namprd02.prod.outlook.com (2603:10b6:510:16::12)\n by CO1PR02MB8666.namprd02.prod.outlook.com (2603:10b6:303:15d::8)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7249.36; Tue, 6 Feb\n 2024 04:29:18 +0000","from PH0PR02MB7496.namprd02.prod.outlook.com\n ([fe80::1618:78d0:e98c:2910]) by PH0PR02MB7496.namprd02.prod.outlook.com\n ([fe80::1618:78d0:e98c:2910%7]) with mapi id 15.20.7249.035; Tue, 6 Feb 2024\n 04:29:17 +0000"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp2.osuosl.org 6E704402E0","OpenDKIM Filter v2.11.0 smtp2.osuosl.org 34F83400CE","OpenDKIM Filter v2.11.0 smtp1.osuosl.org 4A7FF81298"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=148.163.151.68;\n helo=mx0a-002c1b01.pphosted.com; envelope-from=priyankar.jain@nutanix.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp1.osuosl.org 4A7FF81298","DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h=\n message-id:date:subject:to:references:from:in-reply-to\n :content-type:content-transfer-encoding:mime-version; s=\n proofpoint20171006; bh=ZS5WmQuY0w14bbXFElLkztEcLAIpniL+M5ybQBggB\n QU=; b=Bkk5bnzMUpt7xS27Q/iIPPU7lvQymBCgjHsjPI1QVVA9P3DCwSK3lh1eU\n LiUSd9jl1QpXoj8Gvi+28qQFuGvNga3GCG7G4K2TSoxm2eAWyC3AQGUnMr2cpvEB\n T8rYAuL5C6jC/2k/zMudC5FSp9NxrBijG9p+nnoXJ4HRXzr7YY80ipXhr3tzIUWr\n yzXYBTikpN3b5CGFNccCUNl/N+dd8DGX8rsslr3WPxqH6kbtA/5O8i6TC5yJi7tF\n fhcsZPERF4KIEfRwleJ1MS/MdB8O7ODPmR2AQuDlyMG8qWwooYJzEmCETKlsj6ng\n NnZroD0+9R3x3aW/RgGtWL37GDysg==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com;\n s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=ZS5WmQuY0w14bbXFElLkztEcLAIpniL+M5ybQBggBQU=;\n b=SzWkedm5U+plsT/rhRtsX3A+uRklE9loU1HHBVS+SfgXI28DXFc+sJTN4zeFe3iZnCJKjc3FqVhjmzDdlgdIPVgtz5qtssScuTR2WiRloOsFiwx31WSLAuDReL0HrhRGPcN9rCpFH2WMaFcgYNwpdLn1ZlmPAtuBuHSVyIx5DTw+QL4y1eC45llaIy5WP9o20gw6rEAxgFYI8F+CuJwb9XJHZ46pBt7ZyibUJdBtNLQoU8SuA+VOthVO9HaP5ok/SK8a21Geab3p2DqaS8+0KhH/nefnjXOW5NZGWAa618TFYZBpQ4/u+HxoEyOfBajTbGqxIKd60SQIo/M5Bp3FLA=="],"ARC-Seal":"i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;\n b=LMsgRvLo3BVlsiZ9tFdF+NE+WlbMwNNgGgoUhYssO6qJ+rOXyBPaGwHXAWiW0kYZhmGzVLQ1KMB/PYS+v5BX12f0tMy8szhTgIA8wnV1lLXuXE2yaIy8cDnJmq6FEscsbDgNaP7vXLg4Nsp6FihXM2dNso9xykEpuoWvlfLvJlBjjVhJ3x/DqLHCdNNV4G3PRhjfMeORB21K9bGH6nI8+h6o8gHuDQWOhISHl7RGrT4KOruSET8VdSAgYdOVa/uxKKq65z8lwOPxTafwkgOMaCVKOSWxh0JJ42fRvqBNMODA4LF6xEGHK45swOaWIEhYNorA+KxtwIUqcUZ6WRIBEA==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector9901;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=ZS5WmQuY0w14bbXFElLkztEcLAIpniL+M5ybQBggBQU=;\n b=b6zhHdZFkufotWZVQ2Bkegtm7+JRyl+hqLnj9Bxn2cfdQD88WGWKDE1gawh47VHk7WU1yORoeqP0VLnvwbtTbkjfiGo3DK9ZIJBlxe8G9SLjtOk6pFBriFUUanFl8PiiJ5TbsNDQmKtI8qC8Sh4XnCYyY5W6wZpwLvKqqYUUU1yO7XVFBvCTQiW2WrHz7XTN4Ffxnev3Bgbr8KCOkyFIPa+PuFJBdn9sxSUIIc4q3oDlNd2cYUNrvfmnYDHd/TYS+7PACgjfA5KlJPAIAKh5nO9vkcSXHob+Es7t/HDYnD0E4hXhpmtFx1TwVbF7+f4pT/ZD/fnFOnDE4ocqPho3kg==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com;\n dkim=pass header.d=nutanix.com; arc=none","Message-ID":"<95a8b6a9-a1fd-46e7-abd5-b4daa25cae59@nutanix.com>","Date":"Tue, 6 Feb 2024 09:59:10 +0530","User-Agent":"Mozilla Thunderbird","Content-Language":"en-GB","To":"Mark Michelson , dev@openvswitch.org","References":"<20240108130004.51995-1-priyankar.jain@nutanix.com>\n ","From":"Priyankar Jain ","In-Reply-To":"","X-ClientProxiedBy":"MA0PR01CA0069.INDPRD01.PROD.OUTLOOK.COM\n (2603:1096:a01:ad::10) To PH0PR02MB7496.namprd02.prod.outlook.com\n (2603:10b6:510:16::12)","MIME-Version":"1.0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"PH0PR02MB7496:EE_|CO1PR02MB8666:EE_","X-MS-Office365-Filtering-Correlation-Id":"8edd4ca2-db1e-4543-2090-08dc26cc2df8","x-proofpoint-crosstenant":"true","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;","X-Microsoft-Antispam-Message-Info":"\n x9nOZuHHS+P5hzxaCi+Hvvv/lZ/p2ch69QU8WToywfHXKW0XmZKaUWIPUZa1YJwY48f153CV5GnmVOGjmiXukaEAuOX4aKz+JMiYgKNs/dnVn1otV3+coSER+h8Jpef1tVQ+gFmdcZG3RcWSFVN/zFxVftTqMDoIhhWmVJi6CSVDkkDiIyno5X/IU5BF1WKN5Wm2WvTipqRqqbnYPpWBeSt40/FYDmFhmBYunIt2Iq85qkfCKqFDbTQg5Tp2lYrjDiDgLWNYeLYiGpkb1Gf4r2xZF1Gq7343te4KVeXn3QLqMyKHAWPxkKsA638HlnYPC/2fYeqAh1eQryet2X8qGQUlN2qsWYfv2GvCvpTg59xIEcVSaF3iUXOLcqWkCGf9uEQqy8arDoKRxGU/lZGdQdXe0K0b2s2VS6fK/96eT5gO6pOlE5bM5XvuqTXrV14pcwdvS4N+mn7uMerSwURHFV2FM5mgPmhllmKxXLsntKC/oL+OdWj4Z7IT31rNgegpS8ZZ0h/XNMxLhWenbhPFq2Sx3lZfo29TLwOC3RwMm8S5v7zyFQhE63s+PpgskllgFLIMvNhoyuqEVFPc0z6f9k8HBBFenB2PuFvq2EEGSh9Qti6bM+zvijdzCJedwJHhh4YvsMxP8nPGzP0BVKqoSw==","X-Forefront-Antispam-Report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:PH0PR02MB7496.namprd02.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230031)(376002)(396003)(136003)(366004)(346002)(39860400002)(230922051799003)(64100799003)(1800799012)(451199024)(186009)(38100700002)(31686004)(44832011)(83380400001)(86362001)(66574015)(6506007)(6486002)(26005)(2616005)(31696002)(478600001)(6666004)(53546011)(6512007)(36756003)(316002)(41300700001)(66476007)(66946007)(66556008)(8676002)(2906002)(5660300002)(30864003)(8936002)(45980500001)(43740500002)(559001)(579004);\n DIR:OUT; SFP:1102;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"=?utf-8?q?q0H1KF7Jd5gJ4Xa8Ik2B/j8jLUwz?=\n\t=?utf-8?q?SThWlpcTVzTwNDRqcnd3NKFpzbsT95boDoGTtRytkBDxwTb98dsDGSd3zmN0yJHDE?=\n\t=?utf-8?q?DSLaQQFrDpfO9AiHLK4IiGxPuIn+gF1hUReO8BfNv8hwDlT7YFdQyGOWAjB/zrFWj?=\n\t=?utf-8?q?f2hXa2AlR3Q311LwmEmencUwQRgJDq2Hbh3LxFbcHXPfcJpMmkdI7X5VBgPUA8/Ig?=\n\t=?utf-8?q?zuUUGK6NYBjCf+nOxD3xkHaqpcfPE/4wGAJ5gGDjMFWohY+0C/4cxrV4P//B4y7EU?=\n\t=?utf-8?q?oeeDKEPal+HsvFtEM86UGAC66JtDUPM0RMzGxGo4pL7Zq1yNHDaXAr+VUSrGLssNr?=\n\t=?utf-8?q?5uIDwHMyfiBXfsQvLmY6+6O0VFcD48l8/qcaMZQQ58oNsK668JHOHzLoxkQG+BCvz?=\n\t=?utf-8?q?u2qoWseXXz64ocEto2pTHoOOMG6PgSPIOAQdDOFpnApgSQrP7sqbS0KZsb5bb+bgo?=\n\t=?utf-8?q?/uqKFBhRA4344M3MM6FFnI2gBiy1dEYNv/ZGMmBfa9/jPFua8BmdN/qyNtAfFDu71?=\n\t=?utf-8?q?UxCjb1zuzQiwpjKOaPNXd/UXl4OgE/ZQr7vC6Hw5KNgc2uZX+RncQ5kY3Ow1jkQFl?=\n\t=?utf-8?q?zb9Bi24ure5EixiSY8nA5Hp2Gt9Hh3Z16zAwTBgnxgVJPS/xFEB1LXYFPLCIOVU7i?=\n\t=?utf-8?q?26E3WRzzN8Jxm+79spNiq6kat9cPZyu8Ar69sqEi4zv2S+8AUcmG6WO/I++5Rd5EF?=\n\t=?utf-8?q?Mq+PKyi0vAxSaCKIfjzWkc21i1LPObQUQu7r0hn7HRJZ2HCrrB24Ho8etsMk1VGNW?=\n\t=?utf-8?q?K2zoM9lpVCBtL3QqPuxPAjYzLkAi/2dZN14nKOi5UtWNHifUHfi/ZVBrystLtwtIn?=\n\t=?utf-8?q?hFmgy4qQEpHNxZFjZ05U9JTqzpuez4kSjoi6imgn+V7xo8K/gDhX0uddm+G+VH/vh?=\n\t=?utf-8?q?QVUZWGc+PRh37h+ysuRirvMdf8oEEVa6UWQhPMnfDtTyWQd87/rf0HSYjnGaWo0oQ?=\n\t=?utf-8?q?o8sT4OuRNIcPEeEgn/pCrMjMm2Wzi5/wJRdC9u4TLMgmgSfHuXGeIA9bUAzV1bZyb?=\n\t=?utf-8?q?LsQIwwuetANguet0XupHKV4zBhcfvyIDuLKcXSCpIIBUxum3vrQrW6fBs/ViThfl6?=\n\t=?utf-8?q?CnQIfP1mnCX69gGDmuNQ4Bzl5YsUIW4t5fUy5TGWDieczj3vsvertBIowW+ExT3xu?=\n\t=?utf-8?q?4KYObkWAFtg6sXTgEyvi5FPmfmdQKkftRL1xvOBxTtbhkvvpJcup7KyMPD81TdhT+?=\n\t=?utf-8?q?9DeVsgWIRXfmqBppsVHr1oSC6NHWuNKmY13qtiFzi66fPFRe6No94pbUrBv/Fx3qF?=\n\t=?utf-8?q?BG8m2SCkWbJwONxvBFpqZgQbO9GvAe44dSiCYrScy2wmfHpq0dvR58a6yV2NG+ZWG?=\n\t=?utf-8?q?njnxDO5Cm5DO16QWLGXtN1/sPvFLgG3Elpawp6WGQiLKJmkIysUNtVm0/9YFNqKrP?=\n\t=?utf-8?q?z8pc1yHZXyhGsRfpucPDTTaS9ALyAfRS1A307AsHo4Hb2FgppddXtkrPT65N1G03q?=\n\t=?utf-8?q?Ulen3/gYXIYTn6jEV+vr/9g1SKjJsTqI1nMMyED5jFsi8ypq35XuZ4hMoLH6Nairz?=\n\t=?utf-8?q?7hCRaoY8oSU15zAo9x/MXa40+IHA81dinw=3D=3D?=","X-OriginatorOrg":"nutanix.com","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n 8edd4ca2-db1e-4543-2090-08dc26cc2df8","X-MS-Exchange-CrossTenant-AuthSource":"PH0PR02MB7496.namprd02.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"06 Feb 2024 04:29:17.1769 (UTC)","X-MS-Exchange-CrossTenant-FromEntityHeader":"Hosted","X-MS-Exchange-CrossTenant-Id":"bb047546-786f-4de1-bd75-24e5b6f79043","X-MS-Exchange-CrossTenant-MailboxType":"HOSTED","X-MS-Exchange-CrossTenant-UserPrincipalName":"\n Yvu7oRP4YK8kjDWy4C2vbvOh19Vfs0IooKFK3OQMl+FoJh8QFZMu61Cp/Pby4puWCkpXCaobFqIHIgWT2QQzWW3BsOq+jxhr499IJXQvcGA=","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"CO1PR02MB8666","X-Proofpoint-ORIG-GUID":"NdsUixKhyDck4PVGJDxeXIWwcdPdwyj-","X-Proofpoint-GUID":"NdsUixKhyDck4PVGJDxeXIWwcdPdwyj-","X-Proofpoint-Virus-Version":"vendor=baseguard\n engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26\n definitions=2024-02-05_18,2024-01-31_01,2023-05-22_02","X-Proofpoint-Spam-Reason":"safe","Subject":"Re: [ovs-dev] [PATCH ovn v2] northd: Added svc_monitor_ipv4 in\n NB_Global options.","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.15","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "}}]