// Automatically generated by './scripts/generate-doc.sh'. Do not edit, or make the NETOBSERV team aware of the editions.
:_mod-docs-content-type: REFERENCE

[id="network-observability-netobserv-cli-reference_{context}"]
= Network Observability CLI usage

You can use the Network Observability CLI (`oc netobserv`) to pass command-line arguments to capture flows data, packets data, and metrics for further analysis and enable features supported by the Network Observability Operator.

[id="cli-syntax_{context}"]
== Syntax
The basic syntax for `oc netobserv` commands:

.`oc netobserv` syntax
[source,terminal]
----
$ oc netobserv [<command>] [<feature_option>] [<command_options>] <1>
----
<1> Feature options can only be used with the `oc netobserv flows` command. They cannot be used with the `oc netobserv packets` command.

[id="cli-basic-commands_{context}"]
== Basic commands
[cols="3a,8a",options="header"]
.Basic commands
|===
| Command | Description
| flows
| Capture flows information. For subcommands, see the "Flows capture options" table.
| packets
| Capture packets data. For subcommands, see the "Packets capture options" table.
| metrics
| Capture metrics data. For subcommands, see the "Metrics capture options" table.
| follow
| Follow collector logs when running in background.
| stop
| Stop collection by removing agent daemonset.
| copy
| Copy collector generated files locally.
| cleanup
| Remove the Network Observability CLI components.
| version
| Print the software version.
| help
| Show help.
|===

[id="cli-reference-flows-capture-options_{context}"]
== Flows capture options
Flows capture has mandatory commands as well as additional options, such as enabling extra features about packet drops, DNS latencies, Round-trip time, and filtering.

.`oc netobserv flows` syntax
[source,terminal]
----
$ oc netobserv flows [<feature_option>] [<command_options>]
----
[cols="1,1,1",options="header"]
|===
| Option | Description | Default
|--enable_all|                enable all eBPF features                   | false
|--enable_dns|                enable DNS tracking                        | false
|--enable_ipsec|              enable IPsec tracking                      | false
|--enable_network_events|     enable network events monitoring           | false
|--enable_pkt_translation|    enable packet translation                  | false
|--enable_pkt_drop|           enable packet drop                         | false
|--enable_rtt|                enable RTT tracking                        | false
|--enable_udn_mapping|        enable User Defined Network mapping | false
|--get-subnets|               get subnets information                   | false
|--sampling|                  value that determines the ratio of packets being sampled | 1
|--background|                run in background                          | false
|--copy|                      copy the output files locally              | prompt
|--log-level|                 components logs                            | info
|--max-time|                  maximum capture time                       | 5m
|--max-bytes|                 maximum capture bytes                      | 50000000 = 50MB
|--action|                    filter action                              | Accept
|--cidr|                      filter CIDR                                | 0.0.0.0/0
|--direction|                 filter direction                           | –
|--dport|                     filter destination port                    | –
|--dport_range|               filter destination port range              | –
|--dports|                    filter on either of two destination ports  | –
|--drops|                     filter flows with only dropped packets     | false
|--icmp_code|                 filter ICMP code                           | –
|--icmp_type|                 filter ICMP type                           | –
|--node-selector|             capture on specific nodes                  | –
|--peer_ip|                   filter peer IP                             | –
|--peer_cidr|                 filter peer CIDR                           | –
|--port_range|                filter port range                          | –
|--port|                      filter port                                | –
|--ports|                     filter on either of two ports              | –
|--protocol|                  filter protocol                            | –
|--query|                     filter flows by using a custom query          | –
|--sport_range|               filter source port range                   | –
|--sport|                     filter source port                         | –
|--sports|                    filter on either of two source ports       | –
|--tcp_flags|                 filter TCP flags                           | –
|--interfaces|                list of interfaces to monitor, comma separated     | –
|--exclude_interfaces|        list of interfaces to exclude, comma separated     | lo
|===

.Example running flows capture on TCP protocol and port 49051 with PacketDrop and RTT features enabled:
[source,terminal]
----
$ oc netobserv flows --enable_pkt_drop  --enable_rtt --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051
----
[id="cli-reference-packet-capture-options_{context}"]
== Packets capture options
You can filter packets capture data the as same as flows capture by using the filters.
Certain features, such as packets drop, DNS, RTT, and network events, are only available for flows and metrics capture.

.`oc netobserv packets` syntax
[source,terminal]
----
$ oc netobserv packets [<option>]
----
[cols="1,1,1",options="header"]
|===
| Option | Description | Default
|--background|                run in background                          | false
|--copy|                      copy the output files locally              | prompt
|--log-level|                 components logs                            | info
|--max-time|                  maximum capture time                       | 5m
|--max-bytes|                 maximum capture bytes                      | 50000000 = 50MB
|--action|                    filter action                              | Accept
|--cidr|                      filter CIDR                                | 0.0.0.0/0
|--direction|                 filter direction                           | –
|--dport|                     filter destination port                    | –
|--dport_range|               filter destination port range              | –
|--dports|                    filter on either of two destination ports  | –
|--drops|                     filter flows with only dropped packets     | false
|--icmp_code|                 filter ICMP code                           | –
|--icmp_type|                 filter ICMP type                           | –
|--node-selector|             capture on specific nodes                  | –
|--peer_ip|                   filter peer IP                             | –
|--peer_cidr|                 filter peer CIDR                           | –
|--port_range|                filter port range                          | –
|--port|                      filter port                                | –
|--ports|                     filter on either of two ports              | –
|--protocol|                  filter protocol                            | –
|--query|                     filter flows by using a custom query          | –
|--sport_range|               filter source port range                   | –
|--sport|                     filter source port                         | –
|--sports|                    filter on either of two source ports       | –
|--tcp_flags|                 filter TCP flags                           | –
|===

.Example running packets capture on TCP protocol and port 49051:
[source,terminal]
----
$ oc netobserv packets --action=Accept --cidr=0.0.0.0/0 --protocol=TCP --port=49051
----
[id="cli-reference-metrics-capture-options_{context}"]
== Metrics capture options
You can enable features and use filters on metrics capture, the same as flows capture. The generated graphs fill accordingly in the dashboard.

.`oc netobserv metrics` syntax
[source,terminal]
----
$ oc netobserv metrics [<option>]
----
[cols="1,1,1",options="header"]
|===
| Option | Description | Default
|--enable_all|                enable all eBPF features                   | false
|--enable_dns|                enable DNS tracking                        | false
|--enable_ipsec|              enable IPsec tracking                      | false
|--enable_network_events|     enable network events monitoring           | false
|--enable_pkt_translation|    enable packet translation                  | false
|--enable_pkt_drop|           enable packet drop                         | false
|--enable_rtt|                enable RTT tracking                        | false
|--enable_udn_mapping|        enable User Defined Network mapping | false
|--get-subnets|               get subnets information                   | false
|--sampling|                  value that defines the ratio of packets being sampled | 1
|--action|                    filter action                              | Accept
|--cidr|                      filter CIDR                                | 0.0.0.0/0
|--direction|                 filter direction                           | –
|--dport|                     filter destination port                    | –
|--dport_range|               filter destination port range              | –
|--dports|                    filter on either of two destination ports  | –
|--drops|                     filter flows with only dropped packets     | false
|--icmp_code|                 filter ICMP code                           | –
|--icmp_type|                 filter ICMP type                           | –
|--node-selector|             capture on specific nodes                  | –
|--peer_ip|                   filter peer IP                             | –
|--peer_cidr|                 filter peer CIDR                           | –
|--port_range|                filter port range                          | –
|--port|                      filter port                                | –
|--ports|                     filter on either of two ports              | –
|--protocol|                  filter protocol                            | –
|--query|                     filter flows by using a custom query          | –
|--sport_range|               filter source port range                   | –
|--sport|                     filter source port                         | –
|--sports|                    filter on either of two source ports       | –
|--tcp_flags|                 filter TCP flags                           | –
|--include_list|              list of metric names to generate, comma separated           | namespace_flows_total,node_ingress_bytes_total,node_egress_bytes_total,workload_ingress_bytes_total
|--interfaces|                list of interfaces to monitor, comma separated     | –
|--exclude_interfaces|        list of interfaces to exclude, comma separated     | lo
|===

.Example running metrics capture for TCP drops
[source,terminal]
----
$ oc netobserv metrics --enable_pkt_drop --protocol=TCP
----

.Example running metrics capture for list of metric names to generate
[source,terminal]
----
$ oc netobserv metrics --include_list=node,workload
----

[source,terminal]
----
$ oc netobserv metrics --include_list=node_egress_bytes_total,workload_egress_packets_total
----

[source,terminal]
----
$ oc netobserv metrics --enable_all --include_list=node,namespace,workload
----

.Example output for list of metric names
[source, terminal]
----
opt: include_list, value: node,workload
Matching metrics:
 - node_egress_bytes_total
 - node_ingress_bytes_total
 - workload_egress_bytes_total
 - workload_ingress_bytes_total
 - workload_egress_packets_total
 - workload_ingress_packets_total
 - workload_flows_total
 - workload_drop_packets_total
 - workload_drop_bytes_total
----