16.2.2. Capturing packets

Procedure

1. Run the packet capture with filters enabled:

   $ oc netobserv packets --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

2. Add filters to the live table filter prompt in the terminal to refine the incoming packets. An example filter is as follows:

   live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once

3. Use the PageUp and PageDown keys to toggle between None, Resource, Zone, Host, Owner and all of the above.
4. To stop capturing, press Ctrl+C.

5. View the captured data, which is written to a single file in an ./output/pcap directory located in the same path that was used to install the CLI:

   1. The ./output/pcap/<capture_date_time>.pcap file can be opened with Wireshark.