1. Documentation
×

Network Observability CLI (oc netobserv) reference

The Network Observability CLI (oc netobserv) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.

Network Observability CLI usage

You can use the Network Observability CLI (oc netobserv) to pass command line arguments to capture flow data and packet data for further analysis, enable Network Observability Operator features, or pass configuration options to the eBPF agent and flowlogs-pipeline.

Syntax

The basic syntax for oc netobserv commands is as follows:

oc netobserv syntax
$ oc netobserv [<command>] [<feature_option>] [<command_options>] (1)
1 Feature options can only be used with the oc netobserv flows command. They cannot be used with the oc netobserv packets command.

Basic commands

Table 1. Basic commands
Command Description

flows

Capture flows information. For subcommands, see the "Flows capture options" table.

packets

Capture packets data. For subcommands, see the "Packets capture options" table.

cleanup

Remove the Network Observability CLI components.

version

Print the software version.

help

Show help.

Flows capture options

Flows capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

oc netobserv flows syntax
$ oc netobserv flows [<feature_option>] [<command_options>]
Option Description Default

--enable_pktdrop

enable packet drop

false

--enable_dns

enable DNS tracking

false

--enable_rtt

enable RTT tracking

false

--enable_network_events

enable Network events monitoring

false

--enable_filter

enable flow filter

false

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--copy

copy the output files locally

prompt

--direction

filter direction

n/a

--cidr

filter CIDR

0.0.0.0/0

--protocol

filter protocol

n/a

--sport

filter source port

n/a

--dport

filter destination port

n/a

--port

filter port

n/a

--sport_range

filter source port range

n/a

--dport_range

filter destination port range

n/a

--port_range

filter port range

n/a

--sports

filter on either of two source ports

n/a

--dports

filter on either of two destination ports

n/a

--ports

filter on either of two ports

n/a

--tcp_flags

filter TCP flags

n/a

--action

filter action

Accept

--icmp_type

filter ICMP type

n/a

--icmp_code

filter ICMP code

n/a

--peer_ip

filter peer IP

n/a

--interfaces

interfaces to monitor

n/a
Example running flows capture on TCP protocol and port 49051 with PacketDrop and RTT features enabled:
$ oc netobserv flows --enable_pktdrop=true  --enable_rtt=true --enable_filter=true --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

Packets capture options

You can filter on port and protocol for packet capture data.

oc netobserv packets syntax
$ oc netobserv packets [<option>]
Option Description Default

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--copy

copy the output files locally

prompt

--direction

filter direction

n/a

--cidr

filter CIDR

0.0.0.0/0

--protocol

filter protocol

n/a

--sport

filter source port

n/a

--dport

filter destination port

n/a

--port

filter port

n/a

--sport_range

filter source port range

n/a

--dport_range

filter destination port range

n/a

--port_range

filter port range

n/a

--sports

filter on either of two source ports

n/a

--dports

filter on either of two destination ports

n/a

--ports

filter on either of two ports

n/a

--tcp_flags

filter TCP flags

n/a

--action

filter action

Accept

--icmp_type

filter ICMP type

n/a

--icmp_code

filter ICMP code

n/a

--peer_ip

filter peer IP

n/a
Example running packets capture on TCP protocol and port 49051:
$ oc netobserv packets --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051