Chapter 18. Network Observability CLI

flows

Capture flows information. For subcommands, see the "Flows capture options" table.

packets

Capture packets data. For subcommands, see the "Packets capture options" table.

metrics

Capture metrics data. For subcommands, see the "Metrics capture options" table.

follow

Follow collector logs when running in background.

stop

Stop collection by removing agent daemonset.

copy

Copy collector generated files locally.

cleanup

Remove the Network Observability CLI components.

version

Print the software version.

help

Show help.

--enable_all

enable all eBPF features

false

--enable_dns

enable DNS tracking

false

--enable_ipsec

enable IPsec tracking

false

--enable_network_events

enable network events monitoring

false

--enable_pkt_translation

enable packet translation

false

--enable_pkt_drop

enable packet drop

false

--enable_rtt

enable RTT tracking

false

--enable_udn_mapping

enable User Defined Network mapping

false

--get-subnets

get subnets information

false

--privileged

force eBPF agent privileged mode

auto

--sampling

packets sampling interval

1

--background

run in background

false

--copy

copy the output files locally

prompt

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

-

--dport

filter destination port

-

--dport_range

filter destination port range

-

--dports

filter on either of two destination ports

-

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

-

--icmp_type

filter ICMP type

-

--node-selector

capture on specific nodes

-

--peer_ip

filter peer IP

-

--peer_cidr

filter peer CIDR

-

--port_range

filter port range

-

--port

filter port

-

--ports

filter on either of two ports

-

--protocol

filter protocol

-

--query

filter flows using a custom query

-

--sport_range

filter source port range

-

--sport

filter source port

-

--sports

filter on either of two source ports

-

--tcp_flags

filter TCP flags

-

--interfaces

list of interfaces to monitor, comma separated

-

--exclude_interfaces

list of interfaces to exclude, comma separated

lo

--background

run in background

false

--copy

copy the output files locally

prompt

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--enable_openssl

capture TLS plaintext via OpenSSL uprobes

false; privileged agent; recommended: --peer_ip --port

--tls_process_allowlist

restrict TLS uprobes to comma-separated process names

all non-infra; e.g. nginx,envoy

--tls_plaintext_min_bytes

drop TLS plaintext events shorter than N bytes

0; agent env TLS_PLAINTEXT_MIN_BYTES

--tls_plaintext_preview_bytes

PlaintextPreview length; zero means full payload

256

--tls-keylog

path to SSLKEYLOGFILE for pcapng decryption

collector setting

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

-

--dport

filter destination port

-

--dport_range

filter destination port range

-

--dports

filter on either of two destination ports

-

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

-

--icmp_type

filter ICMP type

-

--node-selector

capture on specific nodes

-

--peer_ip

filter peer IP

-

--peer_cidr

filter peer CIDR

-

--port_range

filter port range

-

--port

filter port

-

--ports

filter on either of two ports

-

--protocol

filter protocol

-

--query

filter flows using a custom query

-

--sport_range

filter source port range

-

--sport

filter source port

-

--sports

filter on either of two source ports

-

--tcp_flags

filter TCP flags

-

--enable_all

enable all eBPF features

false

--enable_dns

enable DNS tracking

false

--enable_ipsec

enable IPsec tracking

false

--enable_network_events

enable network events monitoring

false

--enable_pkt_translation

enable packet translation

false

--enable_pkt_drop

enable packet drop

false

--enable_rtt

enable RTT tracking

false

--enable_udn_mapping

enable User Defined Network mapping

false

--get-subnets

get subnets information

false

--privileged

force eBPF agent privileged mode

auto

--sampling

packets sampling interval

1

--background

run in background

false

--log-level

components logs

info

--max-time

maximum capture time

1h

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

-

--dport

filter destination port

-

--dport_range

filter destination port range

-

--dports

filter on either of two destination ports

-

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

-

--icmp_type

filter ICMP type

-

--node-selector

capture on specific nodes

-

--peer_ip

filter peer IP

-

--peer_cidr

filter peer CIDR

-

--port_range

filter port range

-

--port

filter port

-

--ports

filter on either of two ports

-

--protocol

filter protocol

-

--query

filter flows using a custom query

-

--sport_range

filter source port range

-

--sport

filter source port

-

--sports

filter on either of two source ports

-

--tcp_flags

filter TCP flags

-

--include_list

list of metric names to generate, comma separated

namespace_flows_total,node_ingress_bytes_total,node_egress_bytes_total,workload_ingress_bytes_total

--interfaces

list of interfaces to monitor, comma separated

-

--exclude_interfaces

list of interfaces to exclude, comma separated

lo