1. Documentation
×

Network Observability CLI (oc netobserv) reference

The Network Observability CLI (oc netobserv) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.

Network Observability CLI usage

You can use the Network Observability CLI (oc netobserv) to pass command line arguments to capture flows data, packets data, and metrics for further analysis and enable features supported by the Network Observability Operator.

Syntax

The basic syntax for oc netobserv commands:

oc netobserv syntax
$ oc netobserv [<command>] [<feature_option>] [<command_options>] (1)
1 Feature options can only be used with the oc netobserv flows command. They cannot be used with the oc netobserv packets command.

Basic commands

Table 1. Basic commands
Command Description

flows

Capture flows information. For subcommands, see the "Flows capture options" table.

packets

Capture packets data. For subcommands, see the "Packets capture options" table.

metrics

Capture metrics data. For subcommands, see the "Metrics capture options" table.

follow

Follow collector logs when running in background.

stop

Stop collection by removing agent daemonset.

copy

Copy collector generated files locally.

cleanup

Remove the Network Observability CLI components.

version

Print the software version.

help

Show help.

Flows capture options

Flows capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

oc netobserv flows syntax
$ oc netobserv flows [<feature_option>] [<command_options>]
Option Description Default

--enable_all

enable all eBPF features

false

--enable_dns

enable DNS tracking

false

--enable_network_events

enable network events monitoring

false

--enable_pkt_translation

enable packet translation

false

--enable_pkt_drop

enable packet drop

false

--enable_rtt

enable RTT tracking

false

--enable_udn_mapping

enable User Defined Network mapping

false

--get-subnets

get subnets information

false

--background

run in background

false

--copy

copy the output files locally

prompt

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

–

--dport

filter destination port

–

--dport_range

filter destination port range

–

--dports

filter on either of two destination ports

–

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

–

--icmp_type

filter ICMP type

–

--node-selector

capture on specific nodes

–

--peer_ip

filter peer IP

–

--peer_cidr

filter peer CIDR

–

--port_range

filter port range

–

--port

filter port

–

--ports

filter on either of two ports

–

--protocol

filter protocol

–

--regexes

filter flows using regular expression

–

--sport_range

filter source port range

–

--sport

filter source port

–

--sports

filter on either of two source ports

–

--tcp_flags

filter TCP flags

–

--interfaces

interfaces to monitor

–
Example running flows capture on TCP protocol and port 49051 with PacketDrop and RTT features enabled:
$ oc netobserv flows --enable_pkt_drop  --enable_rtt --enable_filter --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

Packets capture options

You can filter packets capture data the as same as flows capture by using the filters. Certain features, such as packets drop, DNS, RTT, and network events, are only available for flows and metrics capture.

oc netobserv packets syntax
$ oc netobserv packets [<option>]
Option Description Default

--background

run in background

false

--copy

copy the output files locally

prompt

--log-level

components logs

info

--max-time

maximum capture time

5m

--max-bytes

maximum capture bytes

50000000 = 50MB

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

–

--dport

filter destination port

–

--dport_range

filter destination port range

–

--dports

filter on either of two destination ports

–

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

–

--icmp_type

filter ICMP type

–

--node-selector

capture on specific nodes

–

--peer_ip

filter peer IP

–

--peer_cidr

filter peer CIDR

–

--port_range

filter port range

–

--port

filter port

–

--ports

filter on either of two ports

–

--protocol

filter protocol

–

--regexes

filter flows using regular expression

–

--sport_range

filter source port range

–

--sport

filter source port

–

--sports

filter on either of two source ports

–

--tcp_flags

filter TCP flags

–
Example running packets capture on TCP protocol and port 49051:
$ oc netobserv packets --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

Metrics capture options

You can enable features and use filters on metrics capture, the same as flows capture. The generated graphs fill accordingly in the dashboard.

oc netobserv metrics syntax
$ oc netobserv metrics [<option>]
Option Description Default

--enable_all

enable all eBPF features

false

--enable_dns

enable DNS tracking

false

--enable_network_events

enable network events monitoring

false

--enable_pkt_translation

enable packet translation

false

--enable_pkt_drop

enable packet drop

false

--enable_rtt

enable RTT tracking

false

--enable_udn_mapping

enable User Defined Network mapping

false

--get-subnets

get subnets information

false

--action

filter action

Accept

--cidr

filter CIDR

0.0.0.0/0

--direction

filter direction

–

--dport

filter destination port

–

--dport_range

filter destination port range

–

--dports

filter on either of two destination ports

–

--drops

filter flows with only dropped packets

false

--icmp_code

filter ICMP code

–

--icmp_type

filter ICMP type

–

--node-selector

capture on specific nodes

–

--peer_ip

filter peer IP

–

--peer_cidr

filter peer CIDR

–

--port_range

filter port range

–

--port

filter port

–

--ports

filter on either of two ports

–

--protocol

filter protocol

–

--regexes

filter flows using regular expression

–

--sport_range

filter source port range

–

--sport

filter source port

–

--sports

filter on either of two source ports

–

--tcp_flags

filter TCP flags

–

--interfaces

interfaces to monitor

–
Example running metrics capture for TCP drops
$ oc netobserv metrics --enable_pkt_drop --enable_filter --protocol=TCP