OS Manuals

/usr/bin/vtep-ctl

Open vSwitch VTEP (Virtual eXtensible LAN Tunnel End Point) schema, controller and ctl utility (vtep-ctl, ovs-vtep)

From ovs-3.7-vtep 3.7.1-r12 (enterprise-packages), captured 2026-11-08 by running vtep-ctl --help (exit 0). permalink

vtep-ctl: VTEP configuration utility
usage: vtep-ctl [OPTIONS] COMMAND [ARG...]

VTEP commands:
  show                        print overview of database contents

Manager commands:
  get-manager                 print the managers
  del-manager                 delete the managers
  [--inactivity-probe=MSECS]
  set-manager TARGET...       set the list of managers to TARGET...

Physical Switch commands:
  add-ps PS                   create a new physical switch named PS
  del-ps PS                   delete PS and all of its ports
  list-ps                     print the names of all the physical switches
  ps-exists PS                exit 2 if PS does not exist

Port commands:
  list-ports PS               print the names of all the ports on PS
  add-port PS PORT            add network device PORT to PS
  del-port PS PORT            delete PORT from PS

Logical Switch commands:
  add-ls LS                   create a new logical switch named LS
  del-ls LS                   delete LS and all of its ports
  list-ls                     print the names of all the logical switches
  ls-exists LS                exit 2 if LS does not exist
  bind-ls PS PORT VLAN LS     bind LS to VLAN on PORT
  unbind-ls PS PORT VLAN      unbind logical switch on VLAN from PORT
  list-bindings PS PORT       list bindings for PORT on PS
  set-replication-mode LS MODE  set replication mode on LS
  get-replication-mode LS       get replication mode on LS

Logical Router commands:
  add-lr LR                   create a new logical router named LR
  del-lr LR                   delete LR
  list-lr                     print the names of all the logical routers
  lr-exists LR                exit 2 if LR does not exist

MAC binding commands:
  add-ucast-local LS MAC [ENCAP] IP   add ucast local entry in LS
  del-ucast-local LS MAC              del ucast local entry from LS
  add-mcast-local LS MAC [ENCAP] IP   add mcast local entry in LS
  del-mcast-local LS MAC [ENCAP] IP   del mcast local entry from LS
  clear-local-macs LS                 clear local mac entries
  list-local-macs LS                  list local mac entries
  add-ucast-remote LS MAC [ENCAP] IP  add ucast remote entry in LS
  del-ucast-remote LS MAC             del ucast remote entry from LS
  add-mcast-remote LS MAC [ENCAP] IP  add mcast remote entry in LS
  del-mcast-remote LS MAC [ENCAP] IP  del mcast remote entry from LS
  clear-remote-macs LS                clear remote mac entries
  list-remote-macs LS                 list remote mac entries

Database commands:
  list TBL [REC]              list RECord (or all records) in TBL
  find TBL CONDITION...       list records satisfying CONDITION in TBL
  get TBL REC COL[:KEY]       print values of COLumns in RECord in TBL
  set TBL REC COL[:KEY]=VALUE set COLumn values in RECord in TBL
  add TBL REC COL [KEY=]VALUE add (KEY=)VALUE to COLumn in RECord in TBL
  remove TBL REC COL [KEY=]VALUE  remove (KEY=)VALUE from COLumn
  clear TBL REC COL           clear values from COLumn in RECord in TBL
  create TBL COL[:KEY]=VALUE  create and initialize new record
  destroy TBL REC             delete RECord from TBL
  wait-until TBL REC [COL[:KEY]=VALUE]  wait until condition is true
Potentially unsafe database commands require --force option.
Database commands may reference a row in each table in the following ways:
  ACL:
    by UUID
  ACL_entry:
    by UUID
  Arp_Sources_Local:
    by UUID
  Arp_Sources_Remote:
    by UUID
  Global:
    by UUID
    as "."
  Logical_Binding_Stats:
    by UUID
  Logical_Router:
    by UUID
    by "name"
  Logical_Switch:
    by UUID
    by "name"
  Manager:
    by UUID
    by "target"
  Mcast_Macs_Local:
    by UUID
  Mcast_Macs_Remote:
    by UUID
  Physical_Locator:
    by UUID
  Physical_Locator_Set:
    by UUID
  Physical_Port:
    by UUID
    by "name"
  Physical_Switch:
    by UUID
    by "name"
  Tunnel:
    by UUID
  Ucast_Macs_Local:
    by UUID
  Ucast_Macs_Remote:
    by UUID

Options:
  --db=DATABASE               connect to DATABASE
                              (default: unix:/run/openvswitch/db.sock)
  -t, --timeout=SECS          wait at most SECS seconds
  --dry-run                   do not commit changes to database
  --oneline                   print exactly one line of output per command

Output formatting options:
  -f, --format=FORMAT         set output formatting to FORMAT
                              ("table", "html", "csv", or "json")
  -d, --data=FORMAT           set table cell output formatting to
                              FORMAT ("string", "bare", or "json")
  --no-headings               omit table heading row
  --pretty                    pretty-print JSON in output
  --bare                      equivalent to "--format=list --data=bare --no-headings"

Logging options:
  -vSPEC, --verbose=SPEC   set logging levels
  -v, --verbose            set maximum verbosity level
  --log-file[=FILE]        enable logging to specified FILE
                           (default: /var/log/openvswitch/vtep-ctl.log)
  --syslog-method=(libc|unix:file|udp:ip:port)
                           specify how to send messages to syslog daemon
  --syslog-target=HOST:PORT  also send syslog msgs to HOST:PORT via UDP
  --no-syslog                 equivalent to --verbose=vtep_ctl:syslog:warn

Active database connection methods:
  tcp:HOST:PORT           PORT at remote HOST
  ssl:HOST:PORT           SSL/TLS PORT at remote HOST
  unix:FILE               Unix domain socket named FILE
Passive database connection methods:
  ptcp:PORT[:IP]          listen to TCP PORT on IP
  pssl:PORT[:IP]          listen for SSL/TLS on PORT on IP
  punix:FILE              listen on Unix domain socket FILE
PKI configuration (required to use SSL/TLS):
  -p, --private-key=FILE  file with private key
  -c, --certificate=FILE  file with certificate for private key
  -C, --ca-cert=FILE      file with peer CA certificate
SSL/TLS options:
  --ssl-protocols=PROTOS    range of SSL/TLS protocols to enable
  --ssl-ciphers=CIPHERS     list of SSL/TLS ciphers to enable
                            with TLSv1.2
  --ssl-ciphersuites=SUITES list of SSL/TLS ciphersuites to
                            enable with TLSv1.3 and later
  --ssl-server-name=NAME    server name for TLS Server Name
                            Indication (SNI)

Other options:
  -h, --help                  display this help message
  -V, --version               display version information
Options (26)
OptionDescriptionSource
--db DATABASESets server as the database server that vtep-ctl contacts to query or modify configuration.help + man
-t, --timeout SECSBy default, or with a secs of 0, vtep-ctl waits forever for a response from the database.help + man + man
--dry-runPrevents vtep-ctl from actually modifying the database.help + man
--onelineModifies the output format so that the output for each command is printed on a single line.help + man
-f, --format FORMATset output formatting to FORMAT ("table", "html", "csv", or "json")help + man + man
-d, --data FORMATSets the formatting for cells within output tables unless the table format is set to json, in which case json formatting is always used when formatting cells.help + man + man
--no-headingsThis option suppresses the heading row that otherwise appears in the first row of table output.help + man
--prettyBy default, JSON in output is printed as compactly as possible.help + man
--bareequivalent to "--format=list --data=bare --no-headings"help + man
-vSPEC, --verbose SPECSets the maximum logging verbosity level, equivalent to --verbose=dbg.help + man
--log-file FILEenable logging to specified FILE (default: /var/log/openvswitch/vtep-ctl.log)help
--syslog-method (libc|unix:file|udp:ip:port)Specify method how syslog messages should be sent to syslog daemon.help + man
--syslog-target HOST:PORTSend syslog messages to UDP port on host, in addition to the system syslog.help + man
--no-syslogBy default, vtep-ctl logs its arguments and the details of any changes that it makes to the system log.help + man
-p, --private-key FILESpecifies a PEM file containing the private key used as vtep-ctl's identity for outgoing SSL/TLS connections.help + man + man
-c, --certificate FILESpecifies a PEM file containing a certificate that certifies the private key specified on -p or --private-key to be trustworthy.help + man + man
-C, --ca-cert FILESpecifies a PEM file containing the CA certificate that vtep-ctl should use to verify certificates presented to it by SSL/TLS peers.help + man + man
--ssl-protocols PROTOSrange of SSL/TLS protocols to enablehelp
--ssl-ciphers CIPHERSlist of SSL/TLS ciphers to enable with TLSv1.2help
--ssl-server-name NAMESpecifies the server name to use for TLS Server Name Indication (SNI).help + man
-h, --helpPrints a brief help message to the console.help + man + man
-V, --versionPrints version information to the console.help + man + man
--max-column-width nFor table output only, limits the width of any column in the output to n columns. (in the manual page but not in --help)man
--bootstrap-ca-cert cacert.pemWhen cacert.pem exists, this option has the same effect as -C or --ca-cert. (in the manual page but not in --help)man
--peer-ca-cert peer-cacert.pemSpecifies a PEM file that contains one or more additional certificates to send to SSL/TLS peers. (in the manual page but not in --help)man
-v (in the manual page but not in --help)man
Exit status (3) from the manual page
0Successful program execution.
1Usage, syntax, or configuration file error.
2The switch argument to ps-exists specified the name of a physical switch that does not exist.

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.