mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
24 lines
2.0 KiB
Plaintext
24 lines
2.0 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// network_observability/observing-network-traffic.adoc
|
|
|
|
:_mod-docs-content-type: CONCEPT
|
|
[id="network-observability-ebpf-flow-rule-filter_{context}"]
|
|
= eBPF flow rule filter
|
|
|
|
[role="_abstract"]
|
|
Control packet capture volume by using eBPF flow rule filtering to specify capture criteria based on ports and CIDR notation, while monitoring filter performance through dedicated health dashboards and Prometheus metrics.
|
|
|
|
You can use rule-based filtering to control the volume of packets cached in the eBPF flow table. For example, a filter can specify that only packets coming from port 100 should be captured. Then only the packets that match the filter are captured and the rest are dropped.
|
|
|
|
You can apply multiple filter rules.
|
|
|
|
[id="ingress-and-egress-traffic-filtering_{context}"]
|
|
== Ingress and egress traffic filtering
|
|
Classless Inter-Domain Routing (CIDR) notation efficiently represents IP address ranges by combining the base IP address with a prefix length. For both ingress and egress traffic, the source IP address is first used to match filter rules configured with CIDR notation. If there is a match, then the filtering proceeds. If there is no match, then the destination IP is used to match filter rules configured with CIDR notation.
|
|
|
|
After matching either the source IP or the destination IP CIDR, you can pinpoint specific endpoints using the `peerIP` to differentiate the destination IP address of the packet. Based on the provisioned action, the flow data is either cached in the eBPF flow table or not cached.
|
|
|
|
[id="dashboard-and-metrics-integrations_{context}"]
|
|
== Dashboard and metrics integrations
|
|
When this option is enabled, the *Netobserv/Health* dashboard for *eBPF agent statistics* now has the *Filtered flows rate* view. Additionally, in *Observe* -> *Metrics* you can query `netobserv_agent_filtered_flows_total` to observe metrics with the reason in *FlowFilterAcceptCounter*, *FlowFilterNoMatchCounter* or *FlowFilterRecjectCounter*. |