검색

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 11. Network Observability CLI

download PDF

11.1. Installing the Network Observability CLI

Warning

The Network Observability CLI (oc netobserv) is temporarily unavailable and is expected to resolve with OCPBUGS-36146.

The Network Observability CLI (oc netobserv) is deployed separately from the Network Observability Operator. The CLI is available as an OpenShift CLI (oc) plugin. It provides a lightweight way to quickly debug and troubleshoot with network observability.

Important

Network Observability CLI (oc netobserv) is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

11.1.1. About the Network Observability CLI

You can quickly debug and troubleshoot networking issues by using the Network Observability CLI (oc netobserv). The Network Observability CLI is a flow and packet visualization tool that relies on eBPF agents to stream collected data to an ephemeral collector pod. It requires no persistent storage during the capture. After the run, the output is transferred to your local machine. This enables quick, live insight into packets and flow data without installing the Network Observability Operator.

Important

CLI capture is meant to run only for short durations, such as 8-10 minutes. If it runs for too long, it can be difficult to delete the running process.

11.1.2. Installing the Network Observability CLI

Installing the Network Observability CLI (oc netobserv) is a separate procedure from the Network Observability Operator installation. This means that, even if you have the Operator installed from OperatorHub, you need to install the CLI separately.

Note

You can optionally use Krew to install the netobserv CLI plugin. For more information, see "Installing a CLI plugin with Krew".

Prerequisites

  • You must install the OpenShift CLI (oc).
  • You must have a macOS or Linux operating system.

Procedure

  1. Download the oc netobserv CLI tar file.
  2. Unpack the archive:

    $ tar xvf netobserv-cli.tar.gz
  3. Make the file executable:

    $ chmod +x ./build/oc-netobserv
  4. Move the extracted netobserv-cli binary to a directory that is on your PATH, such as /usr/local/bin/:

    $ sudo mv ./build/oc-netobserv /usr/local/bin/

Verification

  • Verify that oc netobserv is available:

    $ oc netobserv version

    Example output

    Netobserv CLI version <version>

11.2. Using the Network Observability CLI

You can visualize and filter the flows and packets data directly in the terminal to see specific usage, such as identifying who is using a specific port. The Network Observability CLI collects flows as JSON and database files or packets as a PCAP file, which you can use with third-party tools.

11.2.1. Capturing flows

You can capture flows and filter on any resource or zone in the data to solve use cases, such as displaying Round-Trip Time (RTT) between two zones. Table visualization in the CLI provides viewing and flow search capabilities.

Prerequisites

  • Install the OpenShift CLI (oc).
  • Install the Network Observability CLI (oc netobserv) plugin.

Procedure

  1. Capture flows with filters enabled by running the following command:

    $ oc netobserv flows --enable_filter=true --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051
  2. Add filters to the live table filter prompt in the terminal to further refine the incoming flows. For example:

    live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once
  3. To stop capturing, press Ctrl+C. The data that was captured is written to two separate files in an ./output directory located in the same path used to install the CLI.
  4. View the captured data in the ./output/flow/<capture_date_time>.json JSON file, which contains JSON arrays of the captured data.

    Example JSON file

    {
      "AgentIP": "10.0.1.76",
      "Bytes": 561,
      "DnsErrno": 0,
      "Dscp": 20,
      "DstAddr": "f904:ece9:ba63:6ac7:8018:1e5:7130:0",
      "DstMac": "0A:58:0A:80:00:37",
      "DstPort": 9999,
      "Duplicate": false,
      "Etype": 2048,
      "Flags": 16,
      "FlowDirection": 0,
      "IfDirection": 0,
      "Interface": "ens5",
      "K8S_FlowLayer": "infra",
      "Packets": 1,
      "Proto": 6,
      "SrcAddr": "3e06:6c10:6440:2:a80:37:b756:270f",
      "SrcMac": "0A:58:0A:80:00:01",
      "SrcPort": 46934,
      "TimeFlowEndMs": 1709741962111,
      "TimeFlowRttNs": 121000,
      "TimeFlowStartMs": 1709741962111,
      "TimeReceived": 1709741964
    }

  5. You can use SQLite to inspect the ./output/flow/<capture_date_time>.db database file. For example:

    1. Open the file by running the following command:

      $ sqlite3 ./output/flow/<capture_date_time>.db
    2. Query the data by running a SQLite SELECT statement, for example:

      sqlite> SELECT DnsLatencyMs, DnsFlagsResponseCode, DnsId, DstAddr, DstPort, Interface, Proto, SrcAddr, SrcPort, Bytes, Packets FROM flow WHERE DnsLatencyMs >10 LIMIT 10;

      Example output

      12|NoError|58747|10.128.0.63|57856||17|172.30.0.10|53|284|1
      11|NoError|20486|10.128.0.52|56575||17|169.254.169.254|53|225|1
      11|NoError|59544|10.128.0.103|51089||17|172.30.0.10|53|307|1
      13|NoError|32519|10.128.0.52|55241||17|169.254.169.254|53|254|1
      12|NoError|32519|10.0.0.3|55241||17|169.254.169.254|53|254|1
      15|NoError|57673|10.128.0.19|59051||17|172.30.0.10|53|313|1
      13|NoError|35652|10.0.0.3|46532||17|169.254.169.254|53|183|1
      32|NoError|37326|10.0.0.3|52718||17|169.254.169.254|53|169|1
      14|NoError|14530|10.0.0.3|58203||17|169.254.169.254|53|246|1
      15|NoError|40548|10.0.0.3|45933||17|169.254.169.254|53|174|1

11.2.2. Capturing packets

You can capture packets using the Network Observability CLI.

Prerequisites

  • Install the OpenShift CLI (oc).
  • Install the Network Observability CLI (oc netobserv) plugin.

Procedure

  1. Run the packet capture with filters enabled:

    $ oc netobserv packets tcp,80
  2. Add filters to the live table filter prompt in the terminal to refine the incoming packets. An example filter is as follows:

    live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once
  3. To stop capturing, press Ctrl+C.
  4. View the captured data, which is written to a single file in an ./output/pcap directory located in the same path that was used to install the CLI:

    1. The ./output/pcap/<capture_date_time>.pcap file can be opened with Wireshark.

11.2.3. Cleaning the Network Observability CLI

You can manually clean the CLI workload by running oc netobserv cleanup. This command removes all the CLI components from your cluster.

When you end a capture, this command is run automatically by the client. You might be required to manually run it if you experience connectivity issues.

Procedure

  • Run the following command:

    $ oc netobserv cleanup

11.3. Network Observability CLI (oc netobserv) reference

The Network Observability CLI (oc netobserv) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.

11.3.1. oc netobserv CLI reference

The Network Observability CLI (oc netobserv) is a CLI tool for capturing flow data and packet data for further analysis.

oc netobserv syntax

$ oc netobserv [<command>] [<feature_option>] [<command_options>] 1

1
Feature options can only be used with the oc netobserv flows command. They cannot be used with the oc netobserv packets command.
Table 11.1. Basic commands
CommandDescription

flows

Capture flows information. For subcommands, see the "Flow capture subcommands" table.

packets

Capture packets from a specific protocol or port pair, such as netobserv packets --filter=tcp,80. For more information about packet capture, see the "Packet capture subcommand" table.

cleanup

Remove the Network Observability CLI components.

version

Print the software version.

help

Show help.

11.3.1.1. Network Observability enrichment

The Network Observability enrichment to display zone, node, owner and resource names including optional features about packet drops, DNS latencies and Round-trip time can only be enabled when capturing flows. These do not appear in packet capture pcap output file.

Network Observability enrichment syntax

$ oc netobserv flows [<enrichment_options>] [<subcommands>]

Table 11.2. Network Observability enrichment options
OptionDescriptionPossible valuesDefault

--enable_pktdrop

Enable packet drop.

true, false

false

--enable_rtt

Enable round trip time.

true, false

false

--enable_dns

Enable DNS tracking.

true, false

false

--help

Show help.

-

-

--interfaces

Interfaces to match on the flow. For example, "eth0,eth1".

"<interface>"

-

11.3.1.2. Flow capture options

Flow capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

oc netobserv flows syntax

$ oc netobserv flows [<feature_option>] [<command_options>]

Table 11.3. Flow capture filter options
OptionDescriptionPossible valuesMandatoryDefault

--enable_filter

Enable flow filter.

true, false

Yes

false

--action

Action to apply on the flow.

Accept, Reject

Yes

Accept

--cidr

CIDR to match on the flow.

1.1.1.0/24, 1::100/64, or 0.0.0.0/0

Yes

0.0.0.0/0

--protocol

Protocol to match on the flow

TCP, UDP, SCTP, ICMP, or ICMPv6

No

-

--direction

Direction to match on the flow

Ingress, Egress

No

-

--dport

Destination port to match on the flow.

80, 443, or 49051

no

-

--sport

Source port to match on the flow.

80, 443, or 49051

No

-

--port

Port to match on the flow.

80, 443, or 49051

No

-

--sport_range

Source port range to match on the flow.

80-100 or 443-445

No

-

--dport_range

Destination port range to match on the flow.

80-100

No

-

--port_range

Port range to match on the flow.

80-100 or 443-445

No

-

--icmp_type

ICMP type to match on the flow.

8 or 13

No

-

--icmp_code

ICMP code to match on the flow.

0 or 1

No

-

--peer_ip

Peer IP to match on the flow.

1.1.1.1 or 1::1

No

-

11.3.1.3. Packet capture options

You can filter on port and protocol for packet capture data.

oc netobserv packets syntax

$ oc netobserv packets [<option>]

Table 11.4. Packet capture filter option

Option

Description

Mandatory

Default

<protocol>,<port>

Capture packets from a specific protocol and port pair. Use a comma as delimiter. For example, tcp,80 specifies the tcp protocol and port 80.

Yes

-

Red Hat logoGithubRedditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

© 2024 Red Hat, Inc.