To-analyzer packets dropped due to analyzer port not bound to any SG

[Vedamurthy Joshi]

R3.0.2.0 Build 26

In UI, Monitor> Debug,
Created a analyzer ana3 with VN net1 (Specified net1 is both "Virtual Network" and "Associated Networks" fields)

Did not create any rule.

On another port 10.1.1.12 on the same VN, added this analyzer as the mirror destination.

We see that the port of the analyzer VM 10.1.1.99 is not associated with any SG. Packets desitned to the analyzer are getting dropped

root@nodei27:~# neutron port-list |grep 10.1.1.99
neut| ffb72d8a-8ee6-4428-8594-0433553028db | default-domain__admin__ana3__1__left__1 | 02:17:8a:f4:7f:3b | {"subnet_id": "d467bf8f-bbd8-4f6c-b981-7a720d0d6a6e", "ip_address": "10.1.1.99"} |
root@nodei27:~# neutron port-show ffb72d8a-8ee6-4428-8594-0433553028db
+---------------------+----------------------------------------------------------------------------------+
| Field | Value |
+---------------------+----------------------------------------------------------------------------------+
| admin_state_up | True |
| binding:host_id | nodel9 |
| binding:vif_details | {"port_filter": true} |
| binding:vif_type | vrouter |
| binding:vnic_type | normal |
| device_id | 9af8ba71-cd3d-4236-a1aa-1ac2bbac11b0 |
| device_owner | compute:None |
| fixed_ips | {"subnet_id": "d467bf8f-bbd8-4f6c-b981-7a720d0d6a6e", "ip_address": "10.1.1.99"} |
| id | ffb72d8a-8ee6-4428-8594-0433553028db |
| mac_address | 02:17:8a:f4:7f:3b |
| name | default-domain__admin__ana3__1__left__1 |
| network_id | bff6fdec-984d-4ff6-a4a9-88e662869914 |
| security_groups | |
| status | ACTIVE |
| tenant_id | 1b18515d8f874b0bbe826d1ba4f9300f |
+---------------------+----------------------------------------------------------------------------------+
root@nodei27:~#

  2380732<=>1097272 10.1.1.6:8097 17 (1)
                         10.1.1.99:8089
(Gen: 45, K(nh):72, Action:D(Unknown), Flags:, S(nh):72, Stats:0/0, SPort 62260)

  2443136<=>1416641 10.1.1.12:8097 17 (1)
                         10.1.1.99:8089
(Gen: 21, K(nh):87, Action:D(Unknown), Flags:, S(nh):87, Stats:0/0, SPort 56895)

[Sachin Bansal (sbansal)]

If there is no SG attached to a port, it will allow communication from everything. Can you check the SGs using VNC API to make sure that is the case. Also, how did you determine that the packets were dropped because of SG? The flow output shows Action:D(Unknown).

[Vedamurthy Joshi (vedujoshi)]

The problem was with the port. (8089 instead of 8099)
Thus the icmp unreachable packets were getting discarded