Red Hat Training

A Red Hat training course is available for Red Hat OpenStack Platform

Chapter 5. Capture traffic statistics

Use Skydive to capture the network statistics of an instance’s interface. This is useful for troubleshooting and diagnostics, or determining whether the network works as expected. To do this, first create a capture between the two interfaces, then use the Flows tool to query the captured traffic.

This example shows an ICMP ping between instance-1 and instance-2. The intention is to observe these ICMP packets in a monitoring session:

  1. Review the IP addresses assigned to the instances:

    $ openstack server list
    +--------------------------------------+------------+--------+-----------------------+-------+---------+
    | ID                                   | Name       | Status | Networks              | Image | Flavor  |
    +--------------------------------------+------------+--------+-----------------------+-------+---------+
    | 24a20f49-a23a-4f30-b1c3-d67a8277e42f | instance-2 | ACTIVE | web=192.168.201.19    |       | m1.nano |
    | eea0a3cc-9338-4f01-bc72-df3252a5c689 | instance-1 | ACTIVE | private=192.168.200.3 |       | m1.nano |
    +--------------------------------------+------------+--------+-----------------------+-------+---------+
  2. In the Skydive UI, click Capture in the right-hand pane and click Create.
  3. Click Gremlin Expression to create a query to capture traffic based on custom criteria. For example, you could enter one of the following into the Query field:

    • If you know vm-id of the instance: G.V().Has('ExtID.vm-id', '24a20f49-a23a-4f30-b1c3-d67a8277e42f')
    • If you know the IP address of the instance: G.V().Has('Neutron.IPV4', IPRange('10.0.0.3/32'))
    • If you know the IP address of the interface: G.V().Has('IPV4', '10.0.0.20/24')
    • If you know the IP address but not the mask: G.V().Has('IPV4', IPRANGE('10.0.0.20/32'))

      Note

      Edit the IP address or instance ID to suit your deployment.

  4. Click Start to begin the capture.

    For example, adding the ID of instance-2 to the query: G.V().Has('ExtID.vm-id', '24a20f49-a23a-4f30-b1c3-d67a8277e42f'), the Flows table shows all network traffic for that instance:

    capture single node

    Skydive automatically selects the topology in the diagram. The instance interfaces are indicated by the OpenStack logo:

    capture UI single instance
  5. To view the packet statistics, click on Flows at the bottom of the right-hand pane. Consider enabling Auto refresh for an updated view. This example shows the network traffic moving between instance-1 and instance-2:

    packet capture icmpv4
  6. By default, the Flows UI uses the Gremlin query G.Flows().Sort(), which returns all the captured traffic. Enter your own query into the field to refine this view. For example:

    • Return only ICMPv4 traffic: G.Flows().Has('Application', 'ICMPv4').Limit(10)