stratumctl reachability

Ask whether a source can reach a destination, and if not, which hop drops it

stratumctl reachability [flags]

Aliases: reach

Evaluate a packet through the modeled OVN pipeline and print the hop-by-hop path with a verdict.

–from and –to take <kind>:<value>, where kind is one of:

nic:nic-xxxx an instance network interface
lb:lb-xxxx a load balancer's data-plane port (no security group)
fip:fip-xxxx a floating IP, by its external address
peering:pcx-xxxx the far side of a VPC peering
vpn:cvpn-xxxx an address in a client VPN's client pool
service-endpoint:vpce-x a per-VPC service endpoint
address:192.0.2.11 a bare address inside the VPC
internet anything beyond the provider network

Examples:

stratumctl reachability --from nic:nic-abc --to nic:nic-def --protocol tcp --port 22
stratumctl reachability --from nic:nic-abc --to internet --protocol tcp --port 443
stratumctl reachability --from nic:nic-abc --to peering:pcx-xyz --protocol icmp

This is configuration analysis over the OVN northbound database. It does not send a packet, and it cannot see a dataplane that disagrees with its configuration — a chassis with no geneve tunnels, a dead ovn-controller, a stale flow table. Every non-blocked verdict says so in its caveats; run ‘stratumctl admin ovn doctor’ for the substrate’s own health.

Flags

Flag	Type	Default	Description
--from	string		Source as <kind>:<value> (required)
--port	int	0	Destination port (required for tcp/udp)
--project	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)
--protocol	string	tcp	Protocol: tcp, udp or icmp
--to	string		Destination as <kind>:<value> (required)