I have two VMs set up on different compute hosts, each with a port connected to a provider network. When attempting to configure port mirroring for a VM port on the provider network, the VM loses its connection, and the tap service is unable to mirror traffic. Upon analyzing the flow entries created for the tap flow and service, I identified the problematic flow that disrupts the VM's connection:
table=0, n_packets=0, n_bytes=0, priority=20,dl_dst=fa:16:3e:7f:7d:d1 actions=NORMAL,mod_vlan_vid:3902,output:"patch-int-tap"
I observed that deleting this flow manually from the br-int resolves the issue and restores connectivity to the VM. But, the incoming mirrored traffic to the tap service is still lost; i.e. on the tap service, as spected, I see only outgoing traffic from the mirrored VM, because the conflictive flow allows the mirror for incoming traffic by assigning the vlan_tci to all traffic addressed to the VM mirrored and send it to the tap bridge.
If I recreate the conflictive flow but changing the actions to actions=output:6,mod_vlan_vid:3900,output:patch-int-tap, where port 6 is the port attached to the mirrored VM on br-int, the VM recover connectivity and the mirroring functionality works as expected.
It appears that using the "NORMAL" action is causing conflicts when the mirrored port is connected to a provider network.
Thanks for reporting, I check this issue.