Chapter 7. Observing the network traffic

Procedure

1. Navigate to Observe Network Traffic.
2. In the Network Traffic page, click the Overview tab.

Procedure

1. Navigate to Observe Network Traffic.
2. In the Network Traffic page, click the Traffic flows tab.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster then select the YAML tab.

4. Configure the FlowCollector custom resource so that spec.processor.logTypes, conversationEndTimeout, and conversationHeartbeatInterval parameters are set according to your observation needs. A sample configuration is as follows:

   Configure FlowCollector for conversation tracking

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
    processor:
     logTypes: Flows                              1
     advanced:
      conversationEndTimeout: 10s                 2
      conversationHeartbeatInterval: 30s          3

   1

   When logTypes is set to Flows, only the Flow event is exported. If you set the value to All, both conversation and flow events are exported and visible in the Network Traffic page. To focus only on conversation events, you can specify Conversations which exports the Conversation start, Conversation tick and Conversation end events; or EndedConversations exports only the Conversation end events. Storage requirements are highest for All and lowest for EndedConversations.

   2

   The Conversation end event represents the point when the conversationEndTimeout is reached or the TCP flag is intercepted.

   3

   The Conversation tick event represents each specified interval defined in the FlowCollector conversationHeartbeatInterval parameter while the network connection is active.

   Note

   If you update the logType option, the flows from the previous selection do not clear from the console plugin. For example, if you initially set logType to Conversations for a span of time until 10 AM and then move to EndedConversations, the console plugin shows all conversation events before 10 AM and only ended conversations after 10 AM.

5. Refresh the Network Traffic page on the Traffic flows tab. Notice there are two new columns, Event/Type and Conversation Id. All the Event/Type fields are Flow when Flow is the selected query option.
6. Select Query Options and choose the Log Type, Conversation. Now the Event/Type shows all of the desired conversation events.
7. Next you can filter on a specific conversation ID or switch between the Conversation and Flow log type options from the side panel.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster, and then select the YAML tab.

4. Configure the FlowCollector custom resource for packet drops, for example:

   Example FlowCollector configuration

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     agent:
       type: eBPF
       ebpf:
         features:
          - PacketDrop            1
         privileged: true         2

   1

   You can start reporting the packet drops of each network flow by listing the PacketDrop parameter in the spec.agent.ebpf.features specification list.

   2

   The spec.agent.ebpf.privileged specification value must be true for packet drop tracking.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for Network Observability, select Flow Collector.
3. Select cluster then select the YAML tab.

4. Configure the FlowCollector custom resource. A sample configuration is as follows:

   Configure FlowCollector for DNS tracking

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     agent:
       type: eBPF
       ebpf:
         features:
          - DNSTracking           1
         sampling: 1              2

   1

   You can set the spec.agent.ebpf.features parameter list to enable DNS tracking of each network flow in the web console.

   2

   You can set sampling to a value of 1 for more accurate metrics and to capture DNS latency. For a sampling value greater than 1, you can observe flows with DNS Response Code and DNS Id, and it is unlikely that DNS Latency can be observed.

5. When you refresh the Network Traffic page, there are new DNS representations you can choose to view in the Overview and Traffic Flow views and new filters you can apply.

   1. Select new DNS choices in Manage panels to display graphical visualizations and DNS metrics in the Overview.
   2. Select new choices in Manage columns to add DNS columns to the Traffic Flows view.
   3. Filter on specific DNS metrics, such as DNS Id, DNS Error DNS Latency and DNS Response Code, and see more information from the side panel. The DNS Latency and DNS Response Code columns are shown by default.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. In the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster, and then select the YAML tab.

4. Configure the FlowCollector custom resource for RTT tracing, for example:

   Example FlowCollector configuration

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     agent:
       type: eBPF
       ebpf:
         features:
          - FlowRTT   1

   1

   You can start tracing RTT network flows by listing the FlowRTT parameter in the spec.agent.ebpf.features specification list.

1. In the Overview, select new choices in Manage panels to choose which graphical visualizations of RTT to display.
2. In the Traffic flows table, the Flow RTT column can be seen, and you can manage display in Manage columns.

3. In the Traffic Flows view, you can also expand the side panel to view more information about RTT.

   Example filtering

   1. Click the Common filters Protocol.
   2. Filter the network flow data based on TCP, Ingress direction, and look for FlowRTT values greater than 10,000,000 nanoseconds (10ms).
   3. Remove the Protocol filter.
   4. Filter for Flow RTT values greater than 0 in the Common filters.
4. In the Topology view, click the Display option dropdown. Then click RTT in the edge labels drop-down list.

Procedure

1. In the web console, go to Operators Installed Operators.
2. Under the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster then select the YAML tab.

4. Configure the FlowCollector custom resource so that the spec.processor.addZone parameter is set to true. A sample configuration is as follows:

   Configure FlowCollector for availability zones collection

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
   # ...
    processor:
      addZone: true
   # ...

1. In the Overview tab, you can see Zones as an available Scope.
2. In Network Traffic Traffic flows, Zones are viewable under the SrcK8S_Zone and DstK8S_Zone fields.
3. In the Topology view, you can set Zones as Scope or Group.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for Network Observability, select Flow Collector.
3. Select cluster, then select the YAML tab.

4. Configure the FlowCollector custom resource, similar to the following sample configurations:

   Example 7.1. Filter Kubernetes service traffic to a specific Pod IP endpoint

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     deploymentModel: Direct
     agent:
       type: eBPF
       ebpf:
         flowFilter:
           action: Accept  1
           cidr: 172.210.150.1/24 2
           protocol: SCTP
           direction: Ingress
           destPortRange: 80-100
           peerIP: 10.10.10.10
           enable: true    3

   1

   The required action parameter describes the action that is taken for the flow filter rule. Possible values are Accept or Reject.

   2

   The required cidr parameter provides the IP address and CIDR mask for the flow filter rule and supports IPv4 and IPv6 address formats. If you want to match against any IP address, you can use 0.0.0.0/0 for IPv4 or ::/0 for IPv6.

   3

   You must set spec.agent.ebpf.flowFilter.enable to true to enable this feature.

   Example 7.2. See flows to any addresses outside the cluster

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     deploymentModel: Direct
     agent:
       type: eBPF
       ebpf:
         flowFilter:
           action: Accept  1
           cidr: 0.0.0.0/0 2
           protocol: TCP
           direction: Egress
           sourcePort: 100
           peerIP: 192.168.127.12 3
           enable: true    4

   1

   You can Accept flows based on the criteria in the flowFilter specification.

   2

   The cidr value of 0.0.0.0/0 matches against any IP address.

   3

   See flows after peerIP is configured with 192.168.127.12.

   4

   You must set spec.agent.ebpf.flowFilter.enable to true to enable the feature.

Procedure

1. Navigate to Observe Network Traffic.
2. In the Network Traffic page, click the Topology tab.