1. Documentation
×

Network Observability CLI (oc netobserv) reference

The Network Observability CLI (oc netobserv) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.

oc netobserv CLI reference

The Network Observability CLI (oc netobserv) is a CLI tool for capturing flow data and packet data for further analysis.

oc netobserv syntax
$ oc netobserv [<command>] [<feature_option>] [<command_options>] (1)
1 Feature options can only be used with the oc netobserv flows command. They cannot be used with the oc netobserv packets command.
Table 1. Basic commands
Command Description

flows

Capture flows information. For subcommands, see the "Flow capture subcommands" table.

packets

Capture packets from a specific protocol or port pair, such as netobserv packets --filter=tcp,80. For more information about packet capture, see the "Packet capture subcommand" table.

cleanup

Remove the Network Observability CLI components.

version

Print the software version.

help

Show help.

Network Observability enrichment

The Network Observability enrichment to display zone, node, owner and resource names including optional features about packet drops, DNS latencies and Round-trip time can only be enabled when capturing flows. These do not appear in packet capture pcap output file.

Network Observability enrichment syntax
$ oc netobserv flows [<enrichment_options>] [<subcommands>]
Table 2. Network Observability enrichment options
Option Description Possible values Default

--enable_pktdrop

Enable packet drop.

true, false

false

--enable_rtt

Enable round trip time.

true, false

false

--enable_dns

Enable DNS tracking.

true, false

false

--help

Show help.

-

-

--interfaces

Interfaces to match on the flow. For example, "eth0,eth1".

"<interface>"

-

Flow capture options

Flow capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

oc netobserv flows syntax
$ oc netobserv flows [<feature_option>] [<command_options>]
Table 3. Flow capture filter options
Option Description Possible values Mandatory Default

--enable_filter

Enable flow filter.

true, false

Yes

false

--action

Action to apply on the flow.

Accept, Reject

Yes

Accept

--cidr

CIDR to match on the flow.

1.1.1.0/24, 1::100/64, or 0.0.0.0/0

Yes

0.0.0.0/0

--protocol

Protocol to match on the flow

TCP, UDP, SCTP, ICMP, or ICMPv6

No

-

--direction

Direction to match on the flow

Ingress, Egress

No

-

--dport

Destination port to match on the flow.

80, 443, or 49051

no

-

--sport

Source port to match on the flow.

80, 443, or 49051

No

-

--port

Port to match on the flow.

80, 443, or 49051

No

-

--sport_range

Source port range to match on the flow.

80-100 or 443-445

No

-

--dport_range

Destination port range to match on the flow.

80-100

No

-

--port_range

Port range to match on the flow.

80-100 or 443-445

No

-

--icmp_type

ICMP type to match on the flow.

8 or 13

No

-

--icmp_code

ICMP code to match on the flow.

0 or 1

No

-

--peer_ip

Peer IP to match on the flow.

1.1.1.1 or 1::1

No

-

Packet capture options

You can filter on port and protocol for packet capture data.

oc netobserv packets syntax
$ oc netobserv packets [<option>]
Table 4. Packet capture filter option

Option

Description

Mandatory

Default

<protocol>,<port>

Capture packets from a specific protocol and port pair. Use a comma as delimiter. For example, tcp,80 specifies the tcp protocol and port 80.

Yes

-