이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 11. Network Observability CLI
11.1. Installing the Network Observability CLI
The Network Observability CLI (oc netobserv
) is temporarily unavailable and is expected to resolve with OCPBUGS-36146.
The Network Observability CLI (oc netobserv
) is deployed separately from the Network Observability Operator. The CLI is available as an OpenShift CLI (oc
) plugin. It provides a lightweight way to quickly debug and troubleshoot with network observability.
Network Observability CLI (oc netobserv
) is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.
11.1.1. About the Network Observability CLI
You can quickly debug and troubleshoot networking issues by using the Network Observability CLI (oc netobserv
). The Network Observability CLI is a flow and packet visualization tool that relies on eBPF agents to stream collected data to an ephemeral collector pod. It requires no persistent storage during the capture. After the run, the output is transferred to your local machine. This enables quick, live insight into packets and flow data without installing the Network Observability Operator.
CLI capture is meant to run only for short durations, such as 8-10 minutes. If it runs for too long, it can be difficult to delete the running process.
11.1.2. Installing the Network Observability CLI
Installing the Network Observability CLI (oc netobserv
) is a separate procedure from the Network Observability Operator installation. This means that, even if you have the Operator installed from OperatorHub, you need to install the CLI separately.
You can optionally use Krew to install the netobserv
CLI plugin. For more information, see "Installing a CLI plugin with Krew".
Prerequisites
-
You must install the OpenShift CLI (
oc
). - You must have a macOS or Linux operating system.
Procedure
-
Download the
oc netobserv
CLI tar file. Unpack the archive:
$ tar xvf netobserv-cli.tar.gz
Make the file executable:
$ chmod +x ./build/oc-netobserv
Move the extracted
netobserv-cli
binary to a directory that is on yourPATH
, such as/usr/local/bin/
:$ sudo mv ./build/oc-netobserv /usr/local/bin/
Verification
Verify that
oc netobserv
is available:$ oc netobserv version
Example output
Netobserv CLI version <version>
Additional resources
11.2. Using the Network Observability CLI
You can visualize and filter the flows and packets data directly in the terminal to see specific usage, such as identifying who is using a specific port. The Network Observability CLI collects flows as JSON and database files or packets as a PCAP file, which you can use with third-party tools.
11.2.1. Capturing flows
You can capture flows and filter on any resource or zone in the data to solve use cases, such as displaying Round-Trip Time (RTT) between two zones. Table visualization in the CLI provides viewing and flow search capabilities.
Prerequisites
-
Install the OpenShift CLI (
oc
). -
Install the Network Observability CLI (
oc netobserv
) plugin.
Procedure
Capture flows with filters enabled by running the following command:
$ oc netobserv flows --enable_filter=true --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051
Add filters to the
live table filter
prompt in the terminal to further refine the incoming flows. For example:live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once
-
To stop capturing, press Ctrl+C. The data that was captured is written to two separate files in an
./output
directory located in the same path used to install the CLI. View the captured data in the
./output/flow/<capture_date_time>.json
JSON file, which contains JSON arrays of the captured data.Example JSON file
{ "AgentIP": "10.0.1.76", "Bytes": 561, "DnsErrno": 0, "Dscp": 20, "DstAddr": "f904:ece9:ba63:6ac7:8018:1e5:7130:0", "DstMac": "0A:58:0A:80:00:37", "DstPort": 9999, "Duplicate": false, "Etype": 2048, "Flags": 16, "FlowDirection": 0, "IfDirection": 0, "Interface": "ens5", "K8S_FlowLayer": "infra", "Packets": 1, "Proto": 6, "SrcAddr": "3e06:6c10:6440:2:a80:37:b756:270f", "SrcMac": "0A:58:0A:80:00:01", "SrcPort": 46934, "TimeFlowEndMs": 1709741962111, "TimeFlowRttNs": 121000, "TimeFlowStartMs": 1709741962111, "TimeReceived": 1709741964 }
You can use SQLite to inspect the
./output/flow/<capture_date_time>.db
database file. For example:Open the file by running the following command:
$ sqlite3 ./output/flow/<capture_date_time>.db
Query the data by running a SQLite
SELECT
statement, for example:sqlite> SELECT DnsLatencyMs, DnsFlagsResponseCode, DnsId, DstAddr, DstPort, Interface, Proto, SrcAddr, SrcPort, Bytes, Packets FROM flow WHERE DnsLatencyMs >10 LIMIT 10;
Example output
12|NoError|58747|10.128.0.63|57856||17|172.30.0.10|53|284|1 11|NoError|20486|10.128.0.52|56575||17|169.254.169.254|53|225|1 11|NoError|59544|10.128.0.103|51089||17|172.30.0.10|53|307|1 13|NoError|32519|10.128.0.52|55241||17|169.254.169.254|53|254|1 12|NoError|32519|10.0.0.3|55241||17|169.254.169.254|53|254|1 15|NoError|57673|10.128.0.19|59051||17|172.30.0.10|53|313|1 13|NoError|35652|10.0.0.3|46532||17|169.254.169.254|53|183|1 32|NoError|37326|10.0.0.3|52718||17|169.254.169.254|53|169|1 14|NoError|14530|10.0.0.3|58203||17|169.254.169.254|53|246|1 15|NoError|40548|10.0.0.3|45933||17|169.254.169.254|53|174|1
11.2.2. Capturing packets
You can capture packets using the Network Observability CLI.
Prerequisites
-
Install the OpenShift CLI (
oc
). -
Install the Network Observability CLI (
oc netobserv
) plugin.
Procedure
Run the packet capture with filters enabled:
$ oc netobserv packets tcp,80
Add filters to the
live table filter
prompt in the terminal to refine the incoming packets. An example filter is as follows:live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once
- To stop capturing, press Ctrl+C.
View the captured data, which is written to a single file in an
./output/pcap
directory located in the same path that was used to install the CLI:-
The
./output/pcap/<capture_date_time>.pcap
file can be opened with Wireshark.
-
The
11.2.3. Cleaning the Network Observability CLI
You can manually clean the CLI workload by running oc netobserv cleanup
. This command removes all the CLI components from your cluster.
When you end a capture, this command is run automatically by the client. You might be required to manually run it if you experience connectivity issues.
Procedure
Run the following command:
$ oc netobserv cleanup
Additional resources
11.3. Network Observability CLI (oc netobserv) reference
The Network Observability CLI (oc netobserv
) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.
11.3.1. oc netobserv CLI reference
The Network Observability CLI (oc netobserv
) is a CLI tool for capturing flow data and packet data for further analysis.
oc netobserv
syntax
$ oc netobserv [<command>] [<feature_option>] [<command_options>] 1
- 1
- Feature options can only be used with the
oc netobserv flows
command. They cannot be used with theoc netobserv packets
command.
Command | Description |
---|---|
| Capture flows information. For subcommands, see the "Flow capture subcommands" table. |
|
Capture packets from a specific protocol or port pair, such as |
| Remove the Network Observability CLI components. |
| Print the software version. |
| Show help. |
11.3.1.1. Network Observability enrichment
The Network Observability enrichment to display zone, node, owner and resource names including optional features about packet drops, DNS latencies and Round-trip time can only be enabled when capturing flows. These do not appear in packet capture pcap output file.
Network Observability enrichment syntax
$ oc netobserv flows [<enrichment_options>] [<subcommands>]
Option | Description | Possible values | Default |
---|---|---|---|
| Enable packet drop. |
|
|
| Enable round trip time. |
|
|
| Enable DNS tracking. |
|
|
| Show help. | - | - |
|
Interfaces to match on the flow. For example, |
| - |
11.3.1.2. Flow capture options
Flow capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.
oc netobserv flows
syntax
$ oc netobserv flows [<feature_option>] [<command_options>]
Option | Description | Possible values | Mandatory | Default |
---|---|---|---|---|
| Enable flow filter. |
| Yes |
|
| Action to apply on the flow. |
| Yes |
|
| CIDR to match on the flow. |
| Yes |
|
| Protocol to match on the flow |
| No | - |
| Direction to match on the flow |
| No | - |
| Destination port to match on the flow. |
| no | - |
| Source port to match on the flow. |
| No | - |
| Port to match on the flow. |
| No | - |
| Source port range to match on the flow. |
| No | - |
| Destination port range to match on the flow. |
| No | - |
| Port range to match on the flow. |
| No | - |
| ICMP type to match on the flow. |
| No | - |
| ICMP code to match on the flow. |
| No | - |
| Peer IP to match on the flow. |
| No | - |
11.3.1.3. Packet capture options
You can filter on port and protocol for packet capture data.
oc netobserv packets
syntax
$ oc netobserv packets [<option>]
Option | Description | Mandatory | Default |
|
Capture packets from a specific protocol and port pair. Use a comma as delimiter. For example, | Yes | - |