Network Observability <strong>cli</strong> reference - Network Observability | Observability

Network Observability cli usage

The Network Observability cli (oc netobserv) has most features and filtering options that are available for the Network Observability Operator. You can pass command line arguments to enable features or filtering options.

Network Observability cli usage

You can use the Network Observability cli (oc netobserv) to pass command line arguments to capture flow data and packet data for further analysis, enable Network Observability Operator features, or pass configuration options to the eBPF agent and flowlogs-pipeline.

Syntax

The basic syntax for oc netobserv commands is as follows:

oc netobserv syntax

$ oc netobserv [<command>] [<feature_option>] [<command_options>] (1)

1	Feature options can only be used with the `oc netobserv flows` command. They cannot be used with the `oc netobserv packets` command.

Basic commands

Table 1. Basic commands
Command	Description
flows	Capture flows information. For subcommands, see the "Flows capture options" table.
packets	Capture packets data. For subcommands, see the "Packets capture options" table.
cleanup	Remove the Network Observability cli components.
version	Print the software version.
help	Show help.

Flows capture options

Flows capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

oc netobserv flows syntax

$ oc netobserv flows [<feature_option>] [<command_options>]

Option	Description	Default
--enable_pktdrop	enable packet drop	false
--enable_dns	enable DNS tracking	false
--enable_rtt	enable RTT tracking	false
--enable_network_events	enable Network events monitoring	false
--enable_filter	enable flow filter	false
--log-level	components logs	info
--max-time	maximum capture time	5m
--max-bytes	maximum capture bytes	50000000 = 50MB
--copy	copy the output files locally	prompt
--direction	filter direction	n/a
--cidr	filter CIDR	0.0.0.0/0
--protocol	filter protocol	n/a
--sport	filter source port	n/a
--dport	filter destination port	n/a
--port	filter port	n/a
--sport_range	filter source port range	n/a
--dport_range	filter destination port range	n/a
--port_range	filter port range	n/a
--sports	filter on either of two source ports	n/a
--dports	filter on either of two destination ports	n/a
--ports	filter on either of two ports	n/a
--tcp_flags	filter TCP flags	n/a
--action	filter action	Accept
--icmp_type	filter ICMP type	n/a
--icmp_code	filter ICMP code	n/a
--peer_ip	filter peer IP	n/a
--interfaces	interfaces to monitor	n/a

Option

Description

Default

--enable_pktdrop

enable packet drop

false

--enable_dns

enable DNS tracking

false

--enable_rtt

enable RTT tracking

false

--enable_network_events

enable Network events monitoring

false

--enable_filter

enable flow filter

false

--log-level

components logs

info

--max-time

maximum capture time

--max-bytes

maximum capture bytes

50000000 = 50MB

--copy

copy the output files locally

prompt

--direction

filter direction

n/a

--cidr

filter CIDR

0.0.0.0/0

--protocol

filter protocol

n/a

--sport

filter source port

n/a

--dport

filter destination port

n/a

--port

filter port

n/a

--sport_range

filter source port range

n/a

--dport_range

filter destination port range

n/a

--port_range

filter port range

n/a

--sports

filter on either of two source ports

n/a

--dports

filter on either of two destination ports

n/a

--ports

filter on either of two ports

n/a

--tcp_flags

filter TCP flags

n/a

--action

filter action

--icmp_type

filter ICMP type

n/a

--icmp_code

filter ICMP code

n/a

--peer_ip

filter peer IP

n/a

--interfaces

interfaces to monitor

n/a

Example running flows capture on TCP protocol and port 49051 with PacketDrop and RTT features enabled:

$ oc netobserv flows --enable_pktdrop=true  --enable_rtt=true --enable_filter=true --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

Packets capture options

You can filter on port and protocol for packet capture data.

oc netobserv packets syntax

$ oc netobserv packets [<option>]

Option	Description	Default
--log-level	components logs	info
--max-time	maximum capture time	5m
--max-bytes	maximum capture bytes	50000000 = 50MB
--copy	copy the output files locally	prompt
--direction	filter direction	n/a
--cidr	filter CIDR	0.0.0.0/0
--protocol	filter protocol	n/a
--sport	filter source port	n/a
--dport	filter destination port	n/a
--port	filter port	n/a
--sport_range	filter source port range	n/a
--dport_range	filter destination port range	n/a
--port_range	filter port range	n/a
--sports	filter on either of two source ports	n/a
--dports	filter on either of two destination ports	n/a
--ports	filter on either of two ports	n/a
--tcp_flags	filter TCP flags	n/a
--action	filter action	Accept
--icmp_type	filter ICMP type	n/a
--icmp_code	filter ICMP code	n/a
--peer_ip	filter peer IP	n/a

Option

Description

Default

--log-level

components logs

info

--max-time

maximum capture time

--max-bytes

maximum capture bytes

50000000 = 50MB

--copy

copy the output files locally

prompt

--direction

filter direction

n/a

--cidr

filter CIDR

0.0.0.0/0

--protocol

filter protocol

n/a

--sport

filter source port

n/a

--dport

filter destination port

n/a

--port

filter port

n/a

--sport_range

filter source port range

n/a

--dport_range

filter destination port range

n/a

--port_range

filter port range

n/a

--sports

filter on either of two source ports

n/a

--dports

filter on either of two destination ports

n/a

--ports

filter on either of two ports

n/a

--tcp_flags

filter TCP flags

n/a

--action

filter action

--icmp_type

filter ICMP type

n/a

--icmp_code

filter ICMP code

n/a

--peer_ip

filter peer IP

n/a

Example running packets capture on TCP protocol and port 49051:

$ oc netobserv packets --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051

Network Observability cli (oc netobserv) reference

Network Observability cli usage

Syntax

Basic commands

Flows capture options

Packets capture options