anchor.diff:  
   . moves the host side of the pod's veth interface pair from the *lbr0* bridge
   (where Docker placed it when starting the container) to the OVS bridge *br0*.
  -. adds OpenFlow rules to the OVS database to route traffic addressed
  -to the new pod to the correct OVS port.
  -. in the case of the *multitenant* plugin, it also adds OpenFlow rules to tag
  -traffic coming from the pod with the pod's VNID, and to allow traffic into the
  -pod if the traffic's VNID matches the pod's VNID (or is the privileged VNID
  -0). (Non-matching traffic is filtered out by a generic rule.)
  +. adds OpenFlow rules to the OVS database to route traffic addressed to the new
  +pod to the correct OVS port.
  +ifdef::openshift-origin[]
  +. in the case of the *multitenant* plug-in, adds OpenFlow rules to tag traffic
  +coming from the pod with the pod's VNID, and to allow traffic into the pod if
  +the traffic's VNID matches the pod's VNID (or is the privileged VNID 0).
  +(Non-matching traffic is filtered out by a generic rule.)
  +endif::[]
   
   The pod is allocated an IP address in the cluster subnet by Docker itself
  -because Docker is told to use the *lbr0* bridge, which OpenShift SDN has assigned
  -the cluster gateway address (eg. 10.1.x.1/24).  Note that the *tun0* is also
  -assigned the cluster gateway IP address because it is the default gateway for all
  -traffic destined for external networks, but these two interfaces do not
  -conflict because the *lbr0* interface is only used for IPAM and no OpenShift
  -SDN pods are connected to it.
  +because Docker is told to use the *lbr0* bridge, which OpenShift SDN has
  +assigned the cluster gateway address (eg. 10.1.x.1/24). Note that the *tun0* is
  +also assigned the cluster gateway IP address because it is the default gateway
  +for all traffic destined for external networks, but these two interfaces do not
  +conflict because the *lbr0* interface is only used for IPAM and no OpenShift SDN
  +pods are connected to it.
   
   OpenShift SDN nodes also watch for subnet updates from the SDN master. When a new
   subnet is added, the node adds OpenFlow rules on *br0* so that packets with a
   destination IP address the remote subnet go to *vxlan0* (port 1 on *br0*) and thus
  -out onto the network. The *ovssubnet* plugin sends all packets across the VXLAN
  -with VNID 0, but the *multitenant* plugin uses the appropriate VNID for the
  -source container.
  -
  -==== Packet Flow
  +out onto the network.
  +ifdef::openshift-origin[]
  +The *ovssubnet* plug-in sends all packets across the VXLAN with VNID 0, but the
  +*multitenant* plug-in uses the appropriate VNID for the source container.
  +endif::[]
  +
  +=== Packet Flow
   
   Suppose we have two containers A and B where the peer virtual Ethernet device
   for container A's *eth0* is named *vethA* and the peer for container B's *eth0*
  
positive.code: *_eth0_* _(in A's netns) -> *vethA* -> *br0* -> *tun0* -> (NAT) -> *eth0* (physical device) -> Internet_
  
  Almost all packet delivery decisions are performed with OpenFlow rules in the
  OVS bridge *br0*.  This simplifies the network architecture of the multitenant
  plugin and provides flexible routing and (in the case of the *multitenant*
  plugin) enforceable network isolation.
  
  ==== Network Isolation With the multitenant Plugin
  
  When using the *multitenant* plugin, when a packet exits a pod assigned to a
  non-default project, the OVS bridge *br0* tags that packet with the project's
  assigned VNID.  If the packet is directed to another IP address in the node's
  cluster subnet, the OVS bridge only allows the packet to be delivered to the
  destination pod if the VNIDs match.
  
  
negative.code: ifdef::openshift-enterprise[]
  OpenShift SDN,
  endif::[]
  which configures an overlay network using Open vSwitch (OVS).
  
  ifdef::openshift-origin[]
  OpenShift SDN provides two SDN plug-ins for configuring the network:
  
  * The *ovssubnet* plug-in is the original plug-in which provides a "flat" pod
  network where every pod can communicate with every other pod and service.
  * The *multitenant* plug-in provides isolation between pods based on which
  OpenShift project the pod is assigned to. Each project receives a unique
  Virtual Network ID (VNID) that identifies traffic from pods assigned to the
  project. Pods from different projects cannot send packets to or receive
  packets from pods and services of a different project.
  +
  However, the *default* project (which receives VNID 0) is more privileged in
  that it is allowed to communicate with all other pods, and all other pods can
  communicate with the *default* project. This facilitates certain services (like
  the load balancer) that are run in containers themselves and must talk to all
  other containers.
  endif::[]
  
  ifdef::openshift-enterprise[]
  OpenShift SDN includes the *ovssubnet* SDN plug-in for configuring the network,
  which provides a "flat" pod network where every pod can communicate with every
  other pod and service.
  endif::[]
  
  Following is a detailed discussion of the design and operation of OpenShift SDN,
  which may be useful for troubleshooting.
  
  [[sdn-design-on-masters]]
  
  == Design on Masters
  
  On an OpenShift master, OpenShift SDN maintains a registry of nodes, stored in
  *etcd*. When the system administrator registers a node, OpenShift SDN allocates
  