NETOBSERV-2455 - Get DNS Name #820

jpinsonneau · 2025-10-23T16:10:38Z

Description

Parse truncated DNS QNAME and append it to the flows when available

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

To run a perfscale test, comment with: /test ebpf-node-density-heavy-25nodes

openshift-ci · 2025-10-23T16:10:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign msherif1234 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jpinsonneau · 2025-10-24T10:28:27Z

Tested on OCP 4.19 with CLI by adding the following column in the config:

  - id: DNSName
    group: DNS
    name: DNS Name
    tooltip: DNS query name.
    field: DnsName
    filter: dns_name
    default: false
    width: 15
    feature: dnsTracking

github-actions · 2025-10-24T10:39:18Z

New images:
quay.io/netobserv/ebpf-bytecode:34362e6
quay.io/netobserv/netobserv-ebpf-agent:34362e6

These will expire after two weeks.

To deploy this build, run from the operator repo, assuming the operator is running:

USER=netobserv VERSION=34362e6 make set-agent-image

msherif1234 · 2025-10-24T11:45:56Z

bpf/dns_tracker.h

+    __uint(max_entries, 1);
+    __type(key, u32);
+    __type(value, struct dns_parse_buffer);
+} dns_parse_buffer_map SEC(".maps");


we don't need this additional map, u can directly read dns name from dns record and added to metric

rebased to remove the map: e7fe3e5

msherif1234 · 2025-10-24T11:47:08Z

bpf/dns_tracker.h

+            if (buf) {
+                // Copy raw QNAME bytes (label-encoded) and let userspace decode to dotted form
+                __builtin_memset(buf->name, 0, DNS_NAME_MAX_LEN);
+                u32 qname_off = dns_offset + sizeof(struct dns_header);


pls make sure this math aligns for both DNS over UDP and DNS over TCP , IIRC the headers are of different format

Seems to work on both 🤔
I'll investigate more on that one

[ {"AgentIP":"172.18.0.4","Bytes":404,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"52:33:c4:4a:12:98","DstPort":47143,"Etype":2048,"Flags":784,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth04302c7a"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"0e:84:de:36:65:f6","SrcPort":53,"TimeFlowEndMs":1761648213185,"TimeFlowStartMs":1761648213184,"TimeReceived":1761648213,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":404,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":47143,"Etype":2048,"Flags":784,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648213185,"TimeFlowStartMs":1761648213184,"TimeReceived":1761648213,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":232,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":48277,"DnsLatencyMs":0,"DnsName":"_grpc_config.collector","Dscp":0,"DstAddr":"172.18.0.4","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"netobserv-cli-cluster-worker","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"0e:43:ac:ed:03:f4","DstPort":43215,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648213284,"TimeFlowStartMs":1761648213284,"TimeReceived":1761648213,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"0e:43:ac:ed:03:f4","DstPort":42136,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648213754,"TimeFlowStartMs":1761648213754,"TimeReceived":1761648213,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":404,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"0e:43:ac:ed:03:f4","DstPort":47143,"Etype":2048,"Flags":784,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648213185,"TimeFlowStartMs":1761648213184,"TimeReceived":1761648213,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":223,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":54591,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.4","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"netobserv-cli-cluster-worker","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"0e:43:ac:ed:03:f4","DstPort":62007,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648213282,"TimeFlowStartMs":1761648213282,"TimeReceived":1761648213,"Udns":["",""]}, {"AgentIP":"172.18.0.3","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"ee:c0:bd:f5:3f:9b","DstPort":42136,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648213754,"TimeFlowStartMs":1761648213754,"TimeReceived":1761648214,"Udns":[""]}, {"AgentIP":"172.18.0.3","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":6893,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"4e:3d:b4:df:0d:9f","DstPort":42136,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth9a9a47c1"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"f2:49:c4:df:2e:bf","SrcPort":53,"TimeFlowEndMs":1761648213754,"TimeFlowStartMs":1761648213754,"TimeReceived":1761648214,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":223,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":54591,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.4","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"netobserv-cli-cluster-worker","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"42:6f:2b:75:9e:89","DstPort":62007,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648213282,"TimeFlowStartMs":1761648213282,"TimeReceived":1761648214,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":232,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":48277,"DnsLatencyMs":0,"DnsName":"_grpc_config.collector","Dscp":0,"DstAddr":"172.18.0.4","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"netobserv-cli-cluster-worker","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"42:6f:2b:75:9e:89","DstPort":43215,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648213284,"TimeFlowStartMs":1761648213284,"TimeReceived":1761648214,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":205,"DnsFlags":34048,"DnsFlagsResponseCode":"NoError","DnsId":35219,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"22:c5:11:a1:12:4b","DstPort":58887,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth23eabd9e","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"16:05:90:6e:b9:8c","SrcPort":53,"TimeFlowEndMs":1761648214157,"TimeFlowStartMs":1761648214157,"TimeReceived":1761648214,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":219,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":3594,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"0e:43:ac:ed:03:f4","DstPort":43272,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648214156,"TimeFlowStartMs":1761648214156,"TimeReceived":1761648214,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":219,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":33572,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"0e:43:ac:ed:03:f4","DstPort":57774,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648214156,"TimeFlowStartMs":1761648214156,"TimeReceived":1761648214,"Udns":["",""]}, {"AgentIP":"172.18.0.3","Bytes":205,"DnsFlags":34048,"DnsFlagsResponseCode":"NoError","DnsId":35219,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"ee:c0:bd:f5:3f:9b","DstPort":58887,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648214157,"TimeFlowStartMs":1761648214157,"TimeReceived":1761648215,"Udns":[""]}, {"AgentIP":"172.18.0.3","Bytes":219,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":3594,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"ee:c0:bd:f5:3f:9b","DstPort":43272,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648214156,"TimeFlowStartMs":1761648214156,"TimeReceived":1761648215,"Udns":[""]}, {"AgentIP":"172.18.0.3","Bytes":219,"DnsFlags":34051,"DnsFlagsResponseCode":"NXDomain","DnsId":33572,"DnsLatencyMs":0,"DnsName":"collector.netobserv-cli.svc","Dscp":0,"DstAddr":"172.18.0.3","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"netobserv-cli-cluster-worker2","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"netobserv-cli-cluster-worker2","DstK8S_OwnerType":"Node","DstK8S_Type":"Node","DstMac":"ee:c0:bd:f5:3f:9b","DstPort":57774,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648214156,"TimeFlowStartMs":1761648214156,"TimeReceived":1761648215,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":404,"DnsFlags":33155,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":41203,"Etype":2048,"Flags":784,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648263276,"TimeFlowStartMs":1761648263275,"TimeReceived":1761648263,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":404,"DnsFlags":33155,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"52:33:c4:4a:12:98","DstPort":41203,"Etype":2048,"Flags":784,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth04302c7a"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"0e:84:de:36:65:f6","SrcPort":53,"TimeFlowEndMs":1761648263276,"TimeFlowStartMs":1761648263275,"TimeReceived":1761648263,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"22:c5:11:a1:12:4b","DstPort":39766,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth23eabd9e","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"16:05:90:6e:b9:8c","SrcPort":53,"TimeFlowEndMs":1761648263787,"TimeFlowStartMs":1761648263787,"TimeReceived":1761648263,"Udns":["",""]}, {"AgentIP":"172.18.0.2","Bytes":404,"DnsFlags":33155,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.2.13","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-tcp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-tcp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"22:c5:11:a1:12:4b","DstPort":41203,"Etype":2048,"Flags":784,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth23eabd9e","eth0"],"Packets":4,"Proto":6,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"16:05:90:6e:b9:8c","SrcPort":53,"TimeFlowEndMs":1761648263276,"TimeFlowStartMs":1761648263275,"TimeReceived":1761648263,"Udns":["",""]}, {"AgentIP":"172.18.0.3","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"ee:c0:bd:f5:3f:9b","DstPort":39766,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.2","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-6xl5d","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648263787,"TimeFlowStartMs":1761648263787,"TimeReceived":1761648264,"Udns":[""]}, {"AgentIP":"172.18.0.3","Bytes":172,"DnsFlags":34179,"DnsFlagsResponseCode":"NXDomain","DnsId":22691,"DnsLatencyMs":0,"DnsName":"iamnotavaliddomain.com","Dscp":0,"DstAddr":"10.244.1.14","DstK8S_HostIP":"172.18.0.3","DstK8S_HostName":"netobserv-cli-cluster-worker2","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"4e:3d:b4:df:0d:9f","DstPort":39766,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth9a9a47c1"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"f2:49:c4:df:2e:bf","SrcPort":53,"TimeFlowEndMs":1761648263787,"TimeFlowStartMs":1761648263787,"TimeReceived":1761648264,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":267,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":38776,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.0.2","DstK8S_HostIP":"172.18.0.2","DstK8S_HostName":"netobserv-cli-cluster-control-plane","DstK8S_Name":"coredns-668d6bf9bc-6xl5d","DstK8S_Namespace":"kube-system","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"coredns","DstK8S_OwnerType":"Deployment","DstK8S_Type":"Pod","DstMac":"16:05:90:6e:b9:8c","DstPort":44522,"Etype":2048,"Flags":272,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth23eabd9e"],"Packets":3,"Proto":6,"Sampling":1,"SrcAddr":"172.18.0.1","SrcMac":"22:c5:11:a1:12:4b","SrcPort":53,"TimeFlowEndMs":1761648327877,"TimeFlowStartMs":1761648327876,"TimeReceived":1761648327,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":52045,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"0e:43:ac:ed:03:f4","DstPort":47371,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648358919,"TimeFlowStartMs":1761648358919,"TimeReceived":1761648358,"Udns":["",""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":52045,"DnsLatencyMs":1,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":47371,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648358919,"TimeFlowStartMs":1761648358919,"TimeReceived":1761648359,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":52045,"DnsLatencyMs":1,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"c6:e1:86:de:a2:92","DstPort":47371,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth4aa36302"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"c6:85:41:ed:37:8a","SrcPort":53,"TimeFlowEndMs":1761648358919,"TimeFlowStartMs":1761648358919,"TimeReceived":1761648359,"Udns":[""]}, {"AgentIP":"172.18.0.2","DnsFlags":34176,"DnsFlagsResponseCode":"NoError","DnsId":54455,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"00:00:00:00:00:00","DstPort":41865,"Etype":2048,"FlowDirection":1,"IfDirections":[0],"Interfaces":["unknown"],"Proto":17,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"00:00:00:00:00:00","SrcPort":53,"TimeFlowEndMs":1761648398949,"TimeFlowStartMs":1761648398949,"TimeReceived":1761648398,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":34176,"DnsFlagsResponseCode":"NoError","DnsId":54455,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":41865,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648398949,"TimeFlowStartMs":1761648398949,"TimeReceived":1761648399,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":34176,"DnsFlagsResponseCode":"NoError","DnsId":54455,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"c6:e1:86:de:a2:92","DstPort":41865,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth4aa36302"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"c6:85:41:ed:37:8a","SrcPort":53,"TimeFlowEndMs":1761648398949,"TimeFlowStartMs":1761648398949,"TimeReceived":1761648399,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":12786,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"c6:e1:86:de:a2:92","DstPort":59563,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth4aa36302"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"c6:85:41:ed:37:8a","SrcPort":53,"TimeFlowEndMs":1761648418964,"TimeFlowStartMs":1761648418964,"TimeReceived":1761648419,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":12786,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":59563,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648418964,"TimeFlowStartMs":1761648418964,"TimeReceived":1761648419,"Udns":[""]}, {"AgentIP":"172.18.0.2","Bytes":115,"DnsFlags":33152,"DnsFlagsResponseCode":"NoError","DnsId":12786,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"0e:43:ac:ed:03:f4","DstPort":59563,"Etype":2048,"FlowDirection":1,"IfDirections":[0,1],"Interfaces":["veth9c552442","eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"7a:03:60:f1:63:a4","SrcPort":53,"TimeFlowEndMs":1761648418964,"TimeFlowStartMs":1761648418964,"TimeReceived":1761648419,"Udns":["",""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":34176,"DnsFlagsResponseCode":"NoError","DnsId":29279,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"42:6f:2b:75:9e:89","DstPort":55601,"Etype":2048,"FlowDirection":0,"IfDirections":[0],"Interfaces":["eth0"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.244.0.4","SrcK8S_HostIP":"172.18.0.2","SrcK8S_HostName":"netobserv-cli-cluster-control-plane","SrcK8S_Name":"coredns-668d6bf9bc-pcf2q","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"coredns","SrcK8S_OwnerType":"Deployment","SrcK8S_Type":"Pod","SrcMac":"26:ac:6d:19:4e:11","SrcPort":53,"TimeFlowEndMs":1761648428971,"TimeFlowStartMs":1761648428971,"TimeReceived":1761648429,"Udns":[""]}, {"AgentIP":"172.18.0.4","Bytes":115,"DnsFlags":34176,"DnsFlagsResponseCode":"NoError","DnsId":29279,"DnsLatencyMs":0,"DnsName":"www.google.com","Dscp":0,"DstAddr":"10.244.2.14","DstK8S_HostIP":"172.18.0.4","DstK8S_HostName":"netobserv-cli-cluster-worker","DstK8S_Name":"dnsutils-udp","DstK8S_Namespace":"dns-test","DstK8S_NetworkName":"primary","DstK8S_OwnerName":"dnsutils-udp","DstK8S_OwnerType":"Pod","DstK8S_Type":"Pod","DstMac":"c6:e1:86:de:a2:92","DstPort":55601,"Etype":2048,"FlowDirection":0,"IfDirections":[1],"Interfaces":["veth4aa36302"],"Packets":1,"Proto":17,"Sampling":1,"SrcAddr":"10.96.0.10","SrcK8S_Name":"kube-dns","SrcK8S_Namespace":"kube-system","SrcK8S_NetworkName":"primary","SrcK8S_OwnerName":"kube-dns","SrcK8S_OwnerType":"Service","SrcK8S_Type":"Service","SrcMac":"c6:85:41:ed:37:8a","SrcPort":53,"TimeFlowEndMs":1761648428971,"TimeFlowStartMs":1761648428971,"TimeReceived":1761648429,"Udns":[""]} ]

I've opened a PR on the CLI is someone wanna give a try: netobserv/network-observability-cli#406

msherif1234 · 2025-10-24T11:48:38Z

pkg/decode/decode_protobuf.go

 type Protobuf struct {
 }

+// dnsRawNameToDotted parses a label-encoded DNS QNAME (raw bytes copied from kernel)


this is a good candidate for unit-test as it looks so convoluted

done in a4849cb

msherif1234 · 2025-10-24T11:50:55Z

pkg/decode/decode_protobuf.go

+			break
+		}
+		// Stop on compression pointer (0xC0xx) since we didn't follow it in kernel
+		if (l & 0xC0) == 0xC0 {


what is this 0xC0 magic number ?

That's a skip when a DNS messageg use compression to reduce its size (repeated domain name parts are using pointers).

l is the length byte of a DNS label. 0xC0 in binary is 11000000. The bitwise AND l & 0xC0 isolates the top two bits of l. If the result equals 0xC0, it indicates a compression pointer.

pls add comments with all the above details

done in a4849cb

msherif1234 · 2025-10-24T11:52:02Z

pkg/pbflow/proto.go

 		uint8(mac),
 	}
 }
+


another UT is needed for this

done in a4849cb

msherif1234 · 2025-10-24T18:31:21Z

.mk/bc.mk

 	"additional_flow_metrics":"per_cpu_hash",
 	"packet_record":"ringbuf",
 	"dns_flows":"hash",
+	"dns_parse_buffer_map":"percpu_array",


not needed anymore

done in a4849cb

msherif1234 · 2025-10-28T13:36:50Z

bpf/dns_tracker.h

 #define DNS_DEFAULT_PORT 53
 #define DNS_QR_FLAG 0x8000
+#define DNS_OPCODE_MASK 0x7800
+#define DNS_RCODE_MASK 0x0F


the above are defined but not used anywhere

good catch !

ab1368b

bpf/dns_tracker.h

msherif1234 · 2025-10-29T11:14:30Z

/LGTM

jotak · 2025-10-30T13:32:47Z

@jpinsonneau I've reviewed and overall it looks good to me however I'd just like to understand how wide is the impact of not supporting the compression pointers - in your live tests, did you see it happening often, be it in k8s dns context or when connecting to a public server?
Maybe we should introduce error metrics in the decoding, to track when we could not decode ?

jpinsonneau · 2025-10-30T14:16:00Z

@jpinsonneau I've reviewed and overall it looks good to me however I'd just like to understand how wide is the impact of not supporting the compression pointers - in your live tests, did you see it happening often, be it in k8s dns context or when connecting to a public server? Maybe we should introduce error metrics in the decoding, to track when we could not decode ?

I can run some tests and try to get some numbers 😉

github-actions · 2025-10-31T11:01:51Z

New images:
quay.io/netobserv/ebpf-bytecode:b63d880
quay.io/netobserv/netobserv-ebpf-agent:b63d880

These will expire after two weeks.

To deploy this build, run from the operator repo, assuming the operator is running:

USER=netobserv VERSION=b63d880 make set-agent-image

jpinsonneau · 2025-10-31T11:38:18Z

@jpinsonneau I've reviewed and overall it looks good to me however I'd just like to understand how wide is the impact of not supporting the compression pointers - in your live tests, did you see it happening often, be it in k8s dns context or when connecting to a public server? Maybe we should introduce error metrics in the decoding, to track when we could not decode ?

I can run some tests and try to get some numbers 😉

With current implementation on a real OCP cluster:

20% are truncated because of DNS_NAME_MAX_LEN
1% because of compression pointers. That number is especially low because we can't follow pointers that are outside the truncated bounds

Increasing the max len to 64 helps a bit:

17% are truncated because of DNS_NAME_MAX_LEN
0.8% because of compression pointers

However, that would highly depend of the workload 🤔

openshift-ci · 2025-10-31T16:17:57Z

@jpinsonneau: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/qe-e2e-tests	`ab1368b`	link	false	`/test qe-e2e-tests`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jotak · 2025-11-03T15:42:33Z

/lgtm

jpinsonneau marked this pull request as draft October 23, 2025 16:10

openshift-ci bot added the do-not-merge/work-in-progress label Oct 23, 2025

jpinsonneau force-pushed the dns_name branch from 4ae0d97 to 1569efa Compare October 24, 2025 09:03

jpinsonneau changed the title ~~Get DNS names~~ NETOBSERV-2455 - Get DNS names Oct 24, 2025

jpinsonneau force-pushed the dns_name branch from 1569efa to 407f48a Compare October 24, 2025 09:51

jpinsonneau added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 24, 2025

jpinsonneau requested a review from msherif1234 October 24, 2025 10:58

jpinsonneau marked this pull request as ready for review October 24, 2025 11:03

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 24, 2025

msherif1234 reviewed Oct 24, 2025

View reviewed changes

jpinsonneau force-pushed the dns_name branch from 407f48a to e7fe3e5 Compare October 24, 2025 11:56

github-actions bot removed the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 24, 2025

msherif1234 reviewed Oct 24, 2025

View reviewed changes

jpinsonneau force-pushed the dns_name branch 2 times, most recently from a4849cb to e7874a2 Compare October 28, 2025 13:26

jpinsonneau requested review from jotak and msherif1234 October 28, 2025 13:28

msherif1234 reviewed Oct 28, 2025

View reviewed changes

dns name

ab1368b

jpinsonneau force-pushed the dns_name branch from e7874a2 to ab1368b Compare October 28, 2025 13:39

This was referenced Oct 28, 2025

NETOBSERV-2455 - add DNS Name netobserv/network-observability-cli#406

Open

NETOBSERV-2455 - add DNS Name netobserv/network-observability-operator#2114

Open

jpinsonneau commented Oct 28, 2025

View reviewed changes

bpf/dns_tracker.h Show resolved Hide resolved

jpinsonneau mentioned this pull request Oct 28, 2025

NETOBSERV-2455 - add DNS Name netobserv/network-observability-console-plugin#1090

Open

10 tasks

jpinsonneau changed the title ~~NETOBSERV-2455 - Get DNS names~~ NETOBSERV-2455 - Get DNS Name Oct 28, 2025

openshift-ci bot assigned msherif1234 Oct 29, 2025

openshift-ci bot added the lgtm label Oct 29, 2025

jpinsonneau added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 31, 2025

openshift-ci bot assigned jotak Nov 3, 2025

NETOBSERV-2455 - Get DNS Name #820

Are you sure you want to change the base?

NETOBSERV-2455 - Get DNS Name #820

Uh oh!

Conversation

jpinsonneau commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Dependencies

Checklist

Uh oh!

openshift-ci bot commented Oct 23, 2025

Uh oh!

jpinsonneau commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msherif1234 commented Oct 29, 2025

Uh oh!

jotak commented Oct 30, 2025

Uh oh!

jpinsonneau commented Oct 30, 2025

Uh oh!

github-actions bot commented Oct 31, 2025

Uh oh!

jpinsonneau commented Oct 31, 2025

Uh oh!

openshift-ci bot commented Oct 31, 2025

Uh oh!

jotak commented Nov 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jpinsonneau commented Oct 23, 2025 •

edited

Loading

jpinsonneau commented Oct 24, 2025 •

edited

Loading