16.2. Using the Network Observability CLI

Procedure

1. Capture flows with filters enabled by running the following command:

   $ oc netobserv flows --enable_filter=true --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

2. Add filters to the live table filter prompt in the terminal to further refine the incoming flows. For example:

   live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once

3. Use the PageUp and PageDown keys to toggle between None, Resource, Zone, Host, Owner and all of the above.
4. To stop capturing, press Ctrl+C. The data that was captured is written to two separate files in an ./output directory located in the same path used to install the CLI.

5. View the captured data in the ./output/flow/<capture_date_time>.json JSON file, which contains JSON arrays of the captured data.

   Example JSON file

   {
     "AgentIP": "10.0.1.76",
     "Bytes": 561,
     "DnsErrno": 0,
     "Dscp": 20,
     "DstAddr": "f904:ece9:ba63:6ac7:8018:1e5:7130:0",
     "DstMac": "0A:58:0A:80:00:37",
     "DstPort": 9999,
     "Duplicate": false,
     "Etype": 2048,
     "Flags": 16,
     "FlowDirection": 0,
     "IfDirection": 0,
     "Interface": "ens5",
     "K8S_FlowLayer": "infra",
     "Packets": 1,
     "Proto": 6,
     "SrcAddr": "3e06:6c10:6440:2:a80:37:b756:270f",
     "SrcMac": "0A:58:0A:80:00:01",
     "SrcPort": 46934,
     "TimeFlowEndMs": 1709741962111,
     "TimeFlowRttNs": 121000,
     "TimeFlowStartMs": 1709741962111,
     "TimeReceived": 1709741964
   }

6. You can use SQLite to inspect the ./output/flow/<capture_date_time>.db database file. For example:

   1. Open the file by running the following command:

      $ sqlite3 ./output/flow/<capture_date_time>.db

   2. Query the data by running a SQLite SELECT statement, for example:

      sqlite> SELECT DnsLatencyMs, DnsFlagsResponseCode, DnsId, DstAddr, DstPort, Interface, Proto, SrcAddr, SrcPort, Bytes, Packets FROM flow WHERE DnsLatencyMs >10 LIMIT 10;

      Example output

      12|NoError|58747|10.128.0.63|57856||17|172.30.0.10|53|284|1
      11|NoError|20486|10.128.0.52|56575||17|169.254.169.254|53|225|1
      11|NoError|59544|10.128.0.103|51089||17|172.30.0.10|53|307|1
      13|NoError|32519|10.128.0.52|55241||17|169.254.169.254|53|254|1
      12|NoError|32519|10.0.0.3|55241||17|169.254.169.254|53|254|1
      15|NoError|57673|10.128.0.19|59051||17|172.30.0.10|53|313|1
      13|NoError|35652|10.0.0.3|46532||17|169.254.169.254|53|183|1
      32|NoError|37326|10.0.0.3|52718||17|169.254.169.254|53|169|1
      14|NoError|14530|10.0.0.3|58203||17|169.254.169.254|53|246|1
      15|NoError|40548|10.0.0.3|45933||17|169.254.169.254|53|174|1