ovn-tutorial: Update expected output from show commands

Highlighted requirement on how a fresh sandbox is expected
before doing each of the tutorial sections.

Also added some mentioning of the gdb flags available for
debugging ovn programs.

Signed-off-by: Flavio Fernandes <flavio@flaviof.com>
Signed-off-by: Russell Bryant <russell@ovn.org>

diff --git a/tutorial/OVN-Tutorial.md b/tutorial/OVN-Tutorial.md
index 2bcfc59..5c752d6 100644 (file)
--- a/tutorial/OVN-Tutorial.md
+++ b/tutorial/OVN-Tutorial.md
@@ -34,7 +34,19 @@ environment:
      including [vtep-ctl(8)], [ovn-nbctl(8)], and [ovn-sbctl(8)].
 
 Note that each of these demos assumes you start with a fresh sandbox
-environment.  Re-run `ovs-sandbox` before starting each section.
+environment. **Re-run `ovs-sandbox` before starting each section.**
+
+Using GDB
+---------
+
+GDB support is not required to go through the tutorial. See the “Using GDB”
+section of [Tutorial.md] for more info. Additional flags exist for launching
+the debugger for the OVN programs:
+
+  --gdb-ovn-northd
+  --gdb-ovn-controller
+  --gdb-ovn-controller-vtep
+
 
 1) Simple two-port setup
 ------------------------
@@ -78,19 +90,31 @@ show the logical flows.
 
     $ ovn-sbctl lflow-list
     Datapath: d3466847-2b3a-4f17-8eb2-34f5b0727a70  Pipeline: ingress
-      table=0(port_sec), priority=  100, match=(eth.src[40]), action=(drop;)
-      table=0(port_sec), priority=  100, match=(vlan.present), action=(drop;)
-      table=0(port_sec), priority=   50, match=(inport == "sw0-port1" && eth.src == {00:00:00:00:00:01}), action=(next;)
-      table=0(port_sec), priority=   50, match=(inport == "sw0-port2" && eth.src == {00:00:00:00:00:02}), action=(next;)
-      table=1(     acl), priority=    0, match=(1), action=(next;)
-      table=2( l2_lkup), priority=  100, match=(eth.dst[40]), action=(outport = "_MC_flood"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0-port1"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0-port2"; output;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(eth.src[40]), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(vlan.present), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw0-port1" && eth.src == {00:00:00:00:00:01}), action=(next;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw0-port2" && eth.src == {00:00:00:00:00:02}), action=(next;)
+      table=1(ls_in_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port1" && eth.src == 00:00:00:00:00:01 && arp.sha == 00:00:00:00:00:01), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port1" && eth.src == 00:00:00:00:00:01 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:01) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:01)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port2" && eth.src == 00:00:00:00:00:02 && arp.sha == 00:00:00:00:00:02), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port2" && eth.src == 00:00:00:00:00:02 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:02) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:02)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw0-port1" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw0-port2" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=    0, match=(1), action=(next;)
+      table=3(   ls_in_pre_acl), priority=    0, match=(1), action=(next;)
+      table=4(       ls_in_acl), priority=    0, match=(1), action=(next;)
+      table=5(   ls_in_arp_rsp), priority=    0, match=(1), action=(next;)
+      table=6(   ls_in_l2_lkup), priority=  100, match=(eth.mcast), action=(outport = "_MC_flood"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0-port1"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0-port2"; output;)
     Datapath: d3466847-2b3a-4f17-8eb2-34f5b0727a70  Pipeline: egress
-      table=0(     acl), priority=    0, match=(1), action=(next;)
-      table=1(port_sec), priority=  100, match=(eth.dst[40]), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw0-port1" && eth.dst == {00:00:00:00:00:01}), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw0-port2" && eth.dst == {00:00:00:00:00:02}), action=(output;)
+      table=0(  ls_out_pre_acl), priority=    0, match=(1), action=(next;)
+      table=1(      ls_out_acl), priority=    0, match=(1), action=(next;)
+      table=2(ls_out_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=3(ls_out_port_sec_l2), priority=  100, match=(eth.mcast), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw0-port1" && eth.dst == {00:00:00:00:00:01}), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw0-port2" && eth.dst == {00:00:00:00:00:02}), action=(output;)
 
 Now we can start taking a closer look at how `ovn-controller` has programmed the
 local switch.  Before looking at the flows, we can use `ovs-ofctl` to verify the
@@ -123,27 +147,49 @@ fields have been omitted for brevity.
 
     $ ovs-ofctl -O OpenFlow13 dump-flows br-int
     OFPST_FLOW reply (OF1.3) (xid=0x2):
-     table=0, priority=100,in_port=1 actions=set_field:0x1->metadata,set_field:0x1->reg6,resubmit(,16)
-     table=0, priority=100,in_port=2 actions=set_field:0x1->metadata,set_field:0x2->reg6,resubmit(,16)
-     table=16, priority=100,metadata=0x1,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
+     table=0, priority=100,in_port=1 actions=set_field:0x1->reg5,set_field:0x1->metadata,set_field:0x1->reg6,resubmit(,16)
+     table=0, priority=100,in_port=2 actions=set_field:0x2->reg5,set_field:0x1->metadata,set_field:0x2->reg6,resubmit(,16)
      table=16, priority=100,metadata=0x1,vlan_tci=0x1000/0x1000 actions=drop
+     table=16, priority=100,metadata=0x1,dl_src=01:00:00:00:00:00/01:00:00:00:00:00 actions=drop
      table=16, priority=50,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01 actions=resubmit(,17)
      table=16, priority=50,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02 actions=resubmit(,17)
      table=17, priority=0,metadata=0x1 actions=resubmit(,18)
-     table=18, priority=100,metadata=0x1,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=set_field:0xffff->reg7,resubmit(,32)
-     table=18, priority=50,metadata=0x1,dl_dst=00:00:00:00:00:01 actions=set_field:0x1->reg7,resubmit(,32)
-     table=18, priority=50,metadata=0x1,dl_dst=00:00:00:00:00:02 actions=set_field:0x2->reg7,resubmit(,32)
+     table=18, priority=90,icmp6,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02,icmp_type=136,icmp_code=0,nd_tll=00:00:00:00:00:00 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02,icmp_type=136,icmp_code=0,nd_tll=00:00:00:00:00:02 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01,icmp_type=136,icmp_code=0,nd_tll=00:00:00:00:00:00 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01,icmp_type=136,icmp_code=0,nd_tll=00:00:00:00:00:01 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:01 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:00 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:00 actions=resubmit(,19)
+     table=18, priority=90,icmp6,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02,icmp_type=135,icmp_code=0,nd_sll=00:00:00:00:00:02 actions=resubmit(,19)
+     table=18, priority=90,arp,reg6=0x1,metadata=0x1,dl_src=00:00:00:00:00:01,arp_sha=00:00:00:00:00:01 actions=resubmit(,19)
+     table=18, priority=90,arp,reg6=0x2,metadata=0x1,dl_src=00:00:00:00:00:02,arp_sha=00:00:00:00:00:02 actions=resubmit(,19)
+     table=18, priority=80,icmp6,reg6=0x2,metadata=0x1,icmp_type=136,icmp_code=0 actions=drop
+     table=18, priority=80,icmp6,reg6=0x1,metadata=0x1,icmp_type=136,icmp_code=0 actions=drop
+     table=18, priority=80,icmp6,reg6=0x1,metadata=0x1,icmp_type=135,icmp_code=0 actions=drop
+     table=18, priority=80,icmp6,reg6=0x2,metadata=0x1,icmp_type=135,icmp_code=0 actions=drop
+     table=18, priority=80,arp,reg6=0x2,metadata=0x1 actions=drop
+     table=18, priority=80,arp,reg6=0x1,metadata=0x1 actions=drop
+     table=18, priority=0,metadata=0x1 actions=resubmit(,19)
+     table=19, priority=0,metadata=0x1 actions=resubmit(,20)
+     table=20, priority=0,metadata=0x1 actions=resubmit(,21)
+     table=21, priority=0,metadata=0x1 actions=resubmit(,22)
+     table=22, priority=100,metadata=0x1,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=set_field:0xffff->reg7,resubmit(,32)
+     table=22, priority=50,metadata=0x1,dl_dst=00:00:00:00:00:01 actions=set_field:0x1->reg7,resubmit(,32)
+     table=22, priority=50,metadata=0x1,dl_dst=00:00:00:00:00:02 actions=set_field:0x2->reg7,resubmit(,32)
      table=32, priority=0 actions=resubmit(,33)
-     table=33, priority=100,reg7=0x1,metadata=0x1 actions=resubmit(,34)
-     table=33, priority=100,reg7=0xffff,metadata=0x1 actions=set_field:0x2->reg7,resubmit(,34),set_field:0x1->reg7,resubmit(,34)
-     table=33, priority=100,reg7=0x2,metadata=0x1 actions=resubmit(,34)
+     table=33, priority=100,reg7=0x1,metadata=0x1 actions=set_field:0x1->reg5,resubmit(,34)
+     table=33, priority=100,reg7=0xffff,metadata=0x1 actions=set_field:0x2->reg5,set_field:0x2->reg7,resubmit(,34),set_field:0x1->reg5,set_field:0x1->reg7,resubmit(,34),set_field:0xffff->reg7
+     table=33, priority=100,reg7=0x2,metadata=0x1 actions=set_field:0x2->reg5,resubmit(,34)
      table=34, priority=100,reg6=0x1,reg7=0x1,metadata=0x1 actions=drop
      table=34, priority=100,reg6=0x2,reg7=0x2,metadata=0x1 actions=drop
-     table=34, priority=0 actions=set_field:0->reg0,set_field:0->reg1,set_field:0->reg2,set_field:0->reg3,set_field:0->reg4,set_field:0->reg5,resubmit(,48)
+     table=34, priority=0 actions=set_field:0->reg0,set_field:0->reg1,set_field:0->reg2,set_field:0->reg3,set_field:0->reg4,resubmit(,48)
      table=48, priority=0,metadata=0x1 actions=resubmit(,49)
-     table=49, priority=100,metadata=0x1,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,64)
-     table=49, priority=50,reg7=0x1,metadata=0x1,dl_dst=00:00:00:00:00:01 actions=resubmit(,64)
-     table=49, priority=50,reg7=0x2,metadata=0x1,dl_dst=00:00:00:00:00:02 actions=resubmit(,64)
+     table=49, priority=0,metadata=0x1 actions=resubmit(,50)
+     table=50, priority=0,metadata=0x1 actions=resubmit(,51)
+     table=51, priority=100,metadata=0x1,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,64)
+     table=51, priority=50,reg7=0x2,metadata=0x1,dl_dst=00:00:00:00:00:02 actions=resubmit(,64)
+     table=51, priority=50,reg7=0x1,metadata=0x1,dl_dst=00:00:00:00:00:01 actions=resubmit(,64)
      table=64, priority=100,reg7=0x1,metadata=0x1 actions=output:1
      table=64, priority=100,reg7=0x2,metadata=0x1 actions=output:2
 
@@ -217,33 +263,58 @@ OVN creates separate logical flows for each logical switch.
 
     $ ovn-sbctl lflow-list
     Datapath: 5aa8be0b-8369-49e2-a878-f68872a8d211  Pipeline: ingress
-      table=0(port_sec), priority=  100, match=(eth.src[40]), action=(drop;)
-      table=0(port_sec), priority=  100, match=(vlan.present), action=(drop;)
-      table=0(port_sec), priority=   50, match=(inport == "sw0-port1" && eth.src == {00:00:00:00:00:01}), action=(next;)
-      table=0(port_sec), priority=   50, match=(inport == "sw0-port2" && eth.src == {00:00:00:00:00:02}), action=(next;)
-      table=1(     acl), priority=    0, match=(1), action=(next;)
-      table=2( l2_lkup), priority=  100, match=(eth.dst[40]), action=(outport = "_MC_flood"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0-port1"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0-port2"; output;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(eth.src[40]), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(vlan.present), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw1-port1" && eth.src == {00:00:00:00:00:03}), action=(next;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw1-port2" && eth.src == {00:00:00:00:00:04}), action=(next;)
+      table=1(ls_in_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw1-port1" && eth.src == 00:00:00:00:00:03 && arp.sha == 00:00:00:00:00:03), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw1-port1" && eth.src == 00:00:00:00:00:03 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:03) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:03)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw1-port2" && eth.src == 00:00:00:00:00:04 && arp.sha == 00:00:00:00:00:04), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw1-port2" && eth.src == 00:00:00:00:00:04 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:04) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:04)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw1-port1" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw1-port2" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=    0, match=(1), action=(next;)
+      table=3(   ls_in_pre_acl), priority=    0, match=(1), action=(next;)
+      table=4(       ls_in_acl), priority=    0, match=(1), action=(next;)
+      table=5(   ls_in_arp_rsp), priority=    0, match=(1), action=(next;)
+      table=6(   ls_in_l2_lkup), priority=  100, match=(eth.mcast), action=(outport = "_MC_flood"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:03), action=(outport = "sw1-port1"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:04), action=(outport = "sw1-port2"; output;)
     Datapath: 5aa8be0b-8369-49e2-a878-f68872a8d211  Pipeline: egress
-      table=0(     acl), priority=    0, match=(1), action=(next;)
-      table=1(port_sec), priority=  100, match=(eth.dst[40]), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw0-port1" && eth.dst == {00:00:00:00:00:01}), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw0-port2" && eth.dst == {00:00:00:00:00:02}), action=(output;)
+      table=0(  ls_out_pre_acl), priority=    0, match=(1), action=(next;)
+      table=1(      ls_out_acl), priority=    0, match=(1), action=(next;)
+      table=2(ls_out_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=3(ls_out_port_sec_l2), priority=  100, match=(eth.mcast), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw1-port1" && eth.dst == {00:00:00:00:00:03}), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw1-port2" && eth.dst == {00:00:00:00:00:04}), action=(output;)
     Datapath: 631fb3c9-b0a3-4e56-bac3-1717c8cbb826  Pipeline: ingress
-      table=0(port_sec), priority=  100, match=(eth.src[40]), action=(drop;)
-      table=0(port_sec), priority=  100, match=(vlan.present), action=(drop;)
-      table=0(port_sec), priority=   50, match=(inport == "sw1-port1" && eth.src == {00:00:00:00:00:03}), action=(next;)
-      table=0(port_sec), priority=   50, match=(inport == "sw1-port2" && eth.src == {00:00:00:00:00:04}), action=(next;)
-      table=1(     acl), priority=    0, match=(1), action=(next;)
-      table=2( l2_lkup), priority=  100, match=(eth.dst[40]), action=(outport = "_MC_flood"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:03), action=(outport = "sw1-port1"; output;)
-      table=2( l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:04), action=(outport = "sw1-port2"; output;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(eth.src[40]), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=  100, match=(vlan.present), action=(drop;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw0-port1" && eth.src == {00:00:00:00:00:01}), action=(next;)
+      table=0(ls_in_port_sec_l2), priority=   50, match=(inport == "sw0-port2" && eth.src == {00:00:00:00:00:02}), action=(next;)
+      table=1(ls_in_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port1" && eth.src == 00:00:00:00:00:01 && arp.sha == 00:00:00:00:00:01), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port1" && eth.src == 00:00:00:00:00:01 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:01) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:01)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port2" && eth.src == 00:00:00:00:00:02 && arp.sha == 00:00:00:00:00:02), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   90, match=(inport == "sw0-port2" && eth.src == 00:00:00:00:00:02 && ip6 && nd && ((nd.sll == 00:00:00:00:00:00 || nd.sll == 00:00:00:00:00:02) || ((nd.tll == 00:00:00:00:00:00 || nd.tll == 00:00:00:00:00:02)))), action=(next;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw0-port1" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=   80, match=(inport == "sw0-port2" && (arp || nd)), action=(drop;)
+      table=2(ls_in_port_sec_nd), priority=    0, match=(1), action=(next;)
+      table=3(   ls_in_pre_acl), priority=    0, match=(1), action=(next;)
+      table=4(       ls_in_acl), priority=    0, match=(1), action=(next;)
+      table=5(   ls_in_arp_rsp), priority=    0, match=(1), action=(next;)
+      table=6(   ls_in_l2_lkup), priority=  100, match=(eth.mcast), action=(outport = "_MC_flood"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:01), action=(outport = "sw0-port1"; output;)
+      table=6(   ls_in_l2_lkup), priority=   50, match=(eth.dst == 00:00:00:00:00:02), action=(outport = "sw0-port2"; output;)
     Datapath: 631fb3c9-b0a3-4e56-bac3-1717c8cbb826  Pipeline: egress
-      table=0(     acl), priority=    0, match=(1), action=(next;)
-      table=1(port_sec), priority=  100, match=(eth.dst[40]), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw1-port1" && eth.dst == {00:00:00:00:00:03}), action=(output;)
-      table=1(port_sec), priority=   50, match=(outport == "sw1-port2" && eth.dst == {00:00:00:00:00:04}), action=(output;)
+      table=0(  ls_out_pre_acl), priority=    0, match=(1), action=(next;)
+      table=1(      ls_out_acl), priority=    0, match=(1), action=(next;)
+      table=2(ls_out_port_sec_ip), priority=    0, match=(1), action=(next;)
+      table=3(ls_out_port_sec_l2), priority=  100, match=(eth.mcast), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw0-port1" && eth.dst == {00:00:00:00:00:01}), action=(output;)
+      table=3(ls_out_port_sec_l2), priority=   50, match=(outport == "sw0-port2" && eth.dst == {00:00:00:00:00:02}), action=(output;)
+
 
 In this setup, `sw0-port1` and `sw0-port2` can send packets to each other, but
 not to either of the ports on `sw1`.  This first trace shows a packet from