In Contrail Networking (vRouter), each Virtual Machine Interface (VMI) can be configured for flow-based forwarding or packet-based forwarding. The choice of forwarding mode has a significant impact on performance, especially for North–South traffic such as Internet-facing interfaces.

If you observe that some VMs failing network connectivity to default gateway on vRouter node and in the contrail-tools output hold queue constantly increase, follow the solution below

With Flow mode every new 5‑tuple (TCP/UDP session) creates a flow entry in the vRouter flow table. Higher overhead: consumes flow table resources and triggers hold queue counter increase.

With Packet Mode traffic bypasses flow/session creation. Forwarding is based on routing and next‑hop lookups only. No per-flow state is need and therefore no Contrail security policy enforcement is possible.

You can use the Contrail UI, Navigate to the VMI and enable packet Mode as required.