5.10. Collecting a host network trace

Procedure

1. Run a packet capture from the host network on some nodes by running the following command:

   $ oc adm must-gather \
       --dest-dir /tmp/captures \
       --source-dir '/tmp/tcpdump/' \
       --image registry.redhat.io/openshift4/network-tools-rhel8:latest \
       --node-selector 'node-role.kubernetes.io/worker' \
       --host-network=true \
       --timeout 30s \
       -- \
       tcpdump -i any \
       -w /tmp/tcpdump/%Y-%m-%dT%H:%M:%S.pcap -W 1 -G 300

   where:

   --dest-dir /tmp/captures

   The --dest-dir argument specifies that oc adm must-gather stores the packet captures in directories that are relative to /tmp/captures on the client machine. You can specify any writable directory.

   --source-dir '/tmp/tcpdump/'

   When tcpdump is run in the debug pod that oc adm must-gather starts, the --source-dir argument specifies that the packet captures are temporarily stored in the /tmp/tcpdump directory on the pod.

   --image registry.redhat.io/openshift4/network-tools-rhel8:latest

   The --image argument specifies a container image that includes the tcpdump command.

   --node-selector 'node-role.kubernetes.io/worker'

   The --node-selector argument and example value specifies to perform the packet captures on the worker nodes. As an alternative, you can specify the --node-name argument instead to run the packet capture on a single node. If you omit both the --node-selector and the --node-name argument, the packet captures are performed on all nodes.

   --host-network=true

   The --host-network=true argument is required so that the packet captures are performed on the network interfaces of the node.

   --timeout 30s

   The --timeout argument and value specify to run the debug pod for 30 seconds. If you do not specify the --timeout argument and a duration, the debug pod runs for 10 minutes.

   -i any

   The -i any argument for the tcpdump command specifies to capture packets on all network interfaces. As an alternative, you can specify a network interface name.

2. Perform the action, such as accessing a web application, that triggers the network communication issue while the network trace captures packets.

3. Review the packet capture files that oc adm must-gather transferred from the pods to your client machine:

   tmp/captures
   ├── event-filter.html
   ├── ip-10-0-192-217-ec2-internal
   │   └── registry-redhat-io-openshift4-network-tools-rhel8-sha256-bca...
   │       └── 2022-01-13T19:31:31.pcap
   ├── ip-10-0-201-178-ec2-internal
   │   └── registry-redhat-io-openshift4-network-tools-rhel8-sha256-bca...
   │       └── 2022-01-13T19:31:30.pcap
   ├── ip-...
   └── timestamp

   where:

   ip-10-0-192-217-ec2-internal, ip-10-0-201-178-ec2-internal

   The packet captures are stored in directories that identify the hostname, container, and file name. If you did not specify the --node-selector argument, then the directory level for the hostname is not present.