cmd: add output options for cilium monitor #1112

ianvernon · 2017-07-12T22:05:03Z

By default, when cilium monitor is ran, a one-line summary will be output, only for drop and capture messages.
A new flag, -v for verbose, is added which will output more detailed information about each packet for debug, drop, and capture messages, which was before the default behavior for cilium monitor.

Signed-off by: Ian Vernon ian@covalent.io

By default, when `cilium monitor` is ran, a one-line summary will be output, only for drop and capture messages. A new flag, -v for verbose, is added which will output more detailed information about each packet for debug, drop, and capture messages, which was before the default behavior for `cilium monitor`. Signed-off by: Ian Vernon <ian@covalent.io>

Signed-off-by: Thomas Graf <thomas@cilium.io>

TCP forwarding: <- endpoint 64189, identity 258: 10.15.220.6:51198 -> 10.15.242.54:80 tcp SYN -> ifindex 586: 10.15.220.6:51198 -> 10.15.242.54:80 tcp SYN <- endpoint 33115, identity 257: 10.15.242.54:80 -> 10.15.220.6:51198 tcp ACK, RST -> endpoint 64189, identity 258: 10.15.242.54:80 -> 10.15.220.6:51198 tcp ACK, RST ARP: <- endpoint 33115, identity 257: ea:e1:ad:23:9e:ac -> 1e:19:55:1b:27:a0 ARP -> endpoint 33115, identity 257: 1e:19:55:1b:27:a0 -> ea:e1:ad:23:9e:ac ARP <- endpoint 64189, identity 258: 62:28:3d:b9:16:71 -> ba:15:0d:5c:cb:90 ARP -> endpoint 64189, identity 258: ba:15:0d:5c:cb:90 -> 62:28:3d:b9:16:71 ARP ICMP forwarding: <- endpoint 50098: 10.15.189.46 -> 10.15.222.137 EchoReply -> endpoint 42392: 10.15.189.46 -> 10.15.222.137 EchoReply <- endpoint 42392: 10.15.222.137 -> 10.15.189.46 EchoRequest -> endpoint 50098: 10.15.222.137 -> 10.15.189.46 EchoRequest <- endpoint 50098: 10.15.189.46 -> 10.15.222.137 EchoReply -> endpoint 42392: 10.15.189.46 -> 10.15.222.137 EchoReply Drops: <- endpoint 64189, identity 257: 10.15.220.6 -> 10.15.247.232 EchoRequest xx drop (Policy denied) to endpoint 29898, identity 257->256: 10.15.220.6 -> 10.15.247.232 EchoRequest <- endpoint 64189, identity 257: 10.15.220.6 -> 10.15.247.232 EchoRequest xx drop (Policy denied) to endpoint 29898, identity 257->256: 10.15.220.6 -> 10.15.247.232 EchoRequest Signed-off-by: Thomas Graf <thomas@cilium.io>

Require user to provide --hex flag to disabled decoding and printing in hexadecimal format. Signed-off-by: Thomas Graf <thomas@cilium.io>

Signed-off-by: Thomas Graf <thomas@cilium.io>

Allow to disable basic tracing with --disable-trace agent flag Signed-off-by: Thomas Graf <thomas@cilium.io>

Add --trace-payloadlen option to set length of captured payload Signed-off-by: Thomas Graf <thomas@cilium.io>

houndci-bot · 2017-07-12T22:05:13Z

pkg/bpfdebug/drop.go

@@ -81,8 +81,12 @@ func dropReason(reason uint8) string {
 	return fmt.Sprintf("%d", reason)
 }

+func (n *DropNotify) DumpInfo(data []byte) {


exported method DropNotify.DumpInfo should have comment or be unexported

houndci-bot · 2017-07-12T22:05:13Z

pkg/bpfdebug/debug.go

@@ -268,8 +278,33 @@ type DebugCapture struct {
 	// data
 }

+func (n *DebugCapture) DumpInfo(data []byte) {


exported method DebugCapture.DumpInfo should have comment or be unexported

houndci-bot · 2017-07-12T22:05:14Z

pkg/bpfdebug/debug.go

+type Verbosity uint8
+
+const (
+	INFO Verbosity = iota + 1


exported const INFO should have comment (or a comment on this block) or be unexported

ianvernon · 2017-07-13T22:02:30Z

@tgraf this is a very basic version of the changes proposed in #901. Please let me know if this is on the right track.

tgraf · 2017-07-13T22:27:57Z

@tgraf this is a very basic version of the changes proposed in #901. Please let me know if this is on the right track.

Yes! This is exactly on the right track. I think we can find a better wording. CAPTURE may not be clear to the user. Let's merge something minimal for now to ease the troubleshooting process.

ianvernon · 2017-07-13T23:29:04Z

@tgraf how about "SENDING" or "FORWARDING"?

tgraf · 2017-07-14T00:15:36Z

@tgraf how about "SENDING" or "FORWARDING"?

We have 4 main actions:

the packet enters cilium processing in
the packet is being processed process (we can possibly skip these in non-verbose)
the packet is forwarded out
the packet is dropped drop

Maybe something like this?

in endpoint 200 > 10.1.1.1
out to-proxy
in netdev > 10.1.1.1
out endpoint 300

in netdev > 20.1.1.1
drop (policy denied)

in overlay > 30.1.1.1
out overlay (1.1.1.1)

ianvernon · 2017-07-14T04:43:21Z

OK, I went through the DebugMessage types and pulled out the ones I thought were relevant to what you mentioned above, and reformatted the others accordingly. Currently not all of what you want above is achievable as part of this first pass at this issue (i.e., getting the IPs from the various message types) - it will be once I add more rich metadata as we discussed by querying the API. Let's discuss further on Slack if this isn't what you are looking for so I can nail down the requirements.

This is what the monitor looks like when ran against the 11-getting-started.sh test:

vagrant@cilium-master:~/go/src/github.com/cilium/cilium$ sudo cilium monitor 
Listening for events on 2 CPUs with 64x4096 of shared memory
Press Ctrl-C to quit
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Unknown L3 target address)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid source mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid source mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid source mac)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
from [endpoint 33115] > [ifindex 393]
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 393 / endpoint 33115]
from [seclabel 420] > [container 29898]
drop [ifindex 391 / endpoint 29898] (Policy denied)
from [container 393 / endpoint 33115]
from [seclabel 420] > [container 29898]
drop [ifindex 391 / endpoint 29898] (Policy denied)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Invalid destination mac)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 393 / endpoint 33115]
drop [ifindex 393 / endpoint 33115] (Invalid destination mac)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
from [endpoint 64189] > [ifindex 395]
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Policy denied)
from [container 395 / endpoint 64189]
from [seclabel 421] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 64189]
from [endpoint 64189] > [ifindex 395]
from [container 395 / endpoint 64189]
from [seclabel 421] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 64189]
from [endpoint 64189] > [ifindex 395]
from [container 395 / endpoint 64189]
drop [ifindex 395 / endpoint 64189] (Invalid destination mac)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
from [endpoint 38061] > [ifindex 397]
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (Invalid destination mac)
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (Invalid destination mac)
from [container 397 / endpoint 38061]
from [seclabel 422] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 38061]
from [endpoint 38061] > [ifindex 397]
from [container 397 / endpoint 38061]
from [seclabel 422] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 397 / endpoint 38061]
from [seclabel 422] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 38061]
from [endpoint 38061] > [ifindex 397]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 38061]
from [endpoint 38061] > [ifindex 397]
from [container 397 / endpoint 38061]
from [seclabel 422] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 397 / endpoint 38061]
from [seclabel 422] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 38061]
from [endpoint 38061] > [ifindex 397]
from [container 397 / endpoint 38061]
drop [ifindex 397 / endpoint 38061] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
from [endpoint 11004] > [ifindex 399]
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (Invalid destination mac)
from [container 399 / endpoint 11004]
from [seclabel 423] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 11004]
from [endpoint 11004] > [ifindex 399]
from [container 399 / endpoint 11004]
from [seclabel 423] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 399 / endpoint 11004]
from [seclabel 423] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 11004]
from [endpoint 11004] > [ifindex 399]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 11004]
from [endpoint 11004] > [ifindex 399]
from [container 399 / endpoint 11004]
from [seclabel 423] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 399 / endpoint 11004]
from [seclabel 423] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [seclabel 419] > [container 11004]
from [endpoint 11004] > [ifindex 399]
from [container 399 / endpoint 11004]
drop [ifindex 399 / endpoint 11004] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
from [endpoint 49508] > [ifindex 401]
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Policy denied)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Invalid source mac)
from [container 401 / endpoint 49508]
from [endpoint 49508] > [ifindex 401]
from [container 401 / endpoint 49508]
to host, policy-skip=0
from [endpoint 49508] > [ifindex 388]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
from [endpoint 49508] > [ifindex 401]
from [container 401 / endpoint 49508]
to host, policy-skip=0
from [endpoint 49508] > [ifindex 388]
from [container 401 / endpoint 49508]
to host, policy-skip=0
from [endpoint 49508] > [ifindex 388]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
from [endpoint 49508] > [ifindex 401]
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Invalid source mac)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Invalid source mac)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
to stack, policy-skip=1
from [endpoint 0] > [ifindex 0]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
from [endpoint 29898] > [ifindex 391]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
to stack, policy-skip=1
from [endpoint 0] > [ifindex 0]
from [container 391 / endpoint 29898]
to stack, policy-skip=1
from [endpoint 0] > [ifindex 0]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
from [endpoint 49508] > [ifindex 401]
from [container 401 / endpoint 49508]
to host, policy-skip=0
from [endpoint 49508] > [ifindex 388]
from [container 401 / endpoint 49508]
to host, policy-skip=0
from [endpoint 49508] > [ifindex 388]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
from [endpoint 49508] > [ifindex 401]
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
drop [ifindex 388 / endpoint 49508] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
drop [ifindex 388 / endpoint 49508] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
drop [ifindex 388 / endpoint 49508] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 49508]
drop [ifindex 388 / endpoint 49508] (CT: Can't create entry from packet)
from [container 401 / endpoint 49508]
drop [ifindex 401 / endpoint 49508] (Invalid destination mac)
from [netdev 388 / endpoint 0]
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
from [endpoint 3365] > [ifindex 403]
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 391 / endpoint 29898]
to stack, policy-skip=1
from [endpoint 0] > [ifindex 0]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
from [endpoint 29898] > [ifindex 391]
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [netdev 388 / endpoint 0]
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (Policy denied)
from [container 403 / endpoint 3365]
pre-proxy port 20480 [endpoint 3365]
post-proxy port 4135 [endpoint 3365]
to host, policy-skip=0
from [endpoint 3365] > [ifindex 388]
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [seclabel 1] > [container 3365]
from [endpoint 3365] > [ifindex 403]
from [container 403 / endpoint 3365]
pre-proxy port 20480 [endpoint 3365]
post-proxy port 4135 [endpoint 3365]
to host, policy-skip=0
from [endpoint 3365] > [ifindex 388]
from [container 403 / endpoint 3365]
pre-proxy port 20480 [endpoint 3365]
post-proxy port 4135 [endpoint 3365]
to host, policy-skip=0
from [endpoint 3365] > [ifindex 388]
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [seclabel 1] > [container 3365]
from [endpoint 3365] > [ifindex 403]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [seclabel 1] > [container 3365]
from [endpoint 3365] > [ifindex 403]
from [container 403 / endpoint 3365]
pre-proxy port 20480 [endpoint 3365]
post-proxy port 4135 [endpoint 3365]
to host, policy-skip=0
from [endpoint 3365] > [ifindex 388]
from [container 403 / endpoint 3365]
pre-proxy port 20480 [endpoint 3365]
post-proxy port 4135 [endpoint 3365]
to host, policy-skip=0
from [endpoint 3365] > [ifindex 388]
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [seclabel 1] > [container 3365]
from [endpoint 3365] > [ifindex 403]
from [container 403 / endpoint 3365]
drop [ifindex 403 / endpoint 3365] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [container 391 / endpoint 29898]
drop [ifindex 391 / endpoint 29898] (CT: Can't create entry from packet)
from [netdev 388 / endpoint 0]
pre-proxy port 0 [endpoint 0]
post-proxy port 0 [endpoint 0]
from [netdev 388 / endpoint 0]
from [seclabel 1] > [container 29898]
drop [ifindex 388 / endpoint 29898] (CT: Can't create entry from packet)

houndci-bot · 2017-07-14T04:43:21Z

pkg/bpfdebug/debug.go

@@ -158,6 +158,20 @@ type DebugMsg struct {
 	Arg3    uint32
 }

+
+func (n *DebugMsg) DumpInfo(data []byte) {


exported method DebugMsg.DumpInfo should have comment or be unexported

houndci-bot · 2017-07-15T12:45:48Z

pkg/bpfdebug/dissect.go

+	addTcpFlag := func(flag, new string) string {
+		if flag != "" {
+			return flag + ", " + new
+		} else {


if block ends with a return statement, so drop this else and outdent its block

houndci-bot · 2017-07-15T12:45:49Z

pkg/bpfdebug/dissect.go

@@ -38,6 +39,94 @@ var (
 	lock    sync.Mutex
 )

+func getTCPInfo() string {
+	info := ""
+	addTcpFlag := func(flag, new string) string {


var addTcpFlag should be addTCPFlag

tgraf · 2017-07-15T12:49:28Z

Looks good but will need a rebase. It will conflict due to my BPF changes so daemon/bpf.sha will have to be regenerated for each commit which modifies bpf/

aalemayhu

Overall this is an improvement but looking at the output this seems rushed IMO. For example the filter output now looks weird (sudo ./cilium/cilium monitor --type debug -v).

aalemayhu · 2017-07-17T05:03:09Z

pkg/bpfdebug/drop.go

+// DumpInfo https://techcrunch.com/2017/07/12/soundshroud/
+func (n *DropNotify) DumpInfo(data []byte) {
+	fmt.Printf("xx drop (%s) to endpoint %d, identity %d->%d: %s\n",
+		dropReason(n.SubType), n.DstID, n.SrcLabel, n.DstLabel,


Why is this prefixed xx?

It indicates a dropped packet

This is to make sure that we can dynamically replace the value of pod namespace label (e.g. io.kubernetes.pod.namespace) to the value passed in CLI flag (e.g. --test-namespace). Related: cilium#1112 Signed-off-by: Tam Mach <tam.mach@cilium.io>

Ian Vernon and others added 7 commits July 11, 2017 07:05

bpf: Provide identity in capture messages

3334408

Signed-off-by: Thomas Graf <thomas@cilium.io>

monitor: Decode layers unless disabled

08c7040

Require user to provide --hex flag to disabled decoding and printing in hexadecimal format. Signed-off-by: Thomas Graf <thomas@cilium.io>

monitor: Print separator between messages in non-info mode

70e6175

Signed-off-by: Thomas Graf <thomas@cilium.io>

bpf: Do not require DEBUG flag to emit basic tracing messages

b6d7ec1

Allow to disable basic tracing with --disable-trace agent flag Signed-off-by: Thomas Graf <thomas@cilium.io>

bpf: Make tracing capture len configurable

f797571

Add --trace-payloadlen option to set length of captured payload Signed-off-by: Thomas Graf <thomas@cilium.io>

houndci-bot reviewed Jul 12, 2017

View reviewed changes

ianvernon force-pushed the 901-summary-monitor branch 4 times, most recently from 9cc1a81 to 715f502 Compare July 13, 2017 21:59

ianvernon changed the title ~~WIP - less verbose output for cilium monitor command by default~~ cmd: add output options for cilium monitor Jul 13, 2017

ianvernon assigned tgraf Jul 13, 2017

houndci-bot reviewed Jul 14, 2017

View reviewed changes

ianvernon requested review from tgraf, aalemayhu and aanm July 14, 2017 20:44

houndci-bot reviewed Jul 15, 2017

View reviewed changes

tgraf approved these changes Jul 15, 2017

View reviewed changes

tgraf force-pushed the 901-summary-monitor branch 4 times, most recently from 7911cfa to f797571 Compare July 15, 2017 20:25

tgraf merged commit d8adef7 into master Jul 15, 2017

tgraf deleted the 901-summary-monitor branch July 15, 2017 21:28

aalemayhu reviewed Jul 17, 2017

View reviewed changes

tgraf mentioned this pull request Jul 22, 2017

Add one-line packet forwarded summary for to cilium monitor #901

Closed

aalemayhu mentioned this pull request Aug 15, 2017

Documentation: update monitor output in administrator guide #1316

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

cmd: add output options for cilium monitor #1112

cmd: add output options for cilium monitor #1112

Uh oh!

ianvernon commented Jul 12, 2017 •

edited

Loading

Uh oh!

houndci-bot Jul 12, 2017

Uh oh!

houndci-bot Jul 12, 2017

Uh oh!

houndci-bot Jul 12, 2017

Uh oh!

ianvernon commented Jul 13, 2017

Uh oh!

tgraf commented Jul 13, 2017

Uh oh!

ianvernon commented Jul 13, 2017

Uh oh!

tgraf commented Jul 14, 2017

Uh oh!

ianvernon commented Jul 14, 2017 •

edited

Loading

Uh oh!

houndci-bot Jul 14, 2017

Uh oh!

houndci-bot Jul 15, 2017

Uh oh!

houndci-bot Jul 15, 2017

Uh oh!

tgraf commented Jul 15, 2017

Uh oh!

aalemayhu left a comment

Uh oh!

aalemayhu Jul 17, 2017

Uh oh!

tgraf Jul 17, 2017

Uh oh!

Uh oh!

cmd: add output options for cilium monitor #1112

cmd: add output options for cilium monitor #1112

Uh oh!

Conversation

ianvernon commented Jul 12, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ianvernon commented Jul 13, 2017

Uh oh!

tgraf commented Jul 13, 2017

Uh oh!

ianvernon commented Jul 13, 2017

Uh oh!

tgraf commented Jul 14, 2017

Uh oh!

ianvernon commented Jul 14, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tgraf commented Jul 15, 2017

Uh oh!

aalemayhu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ianvernon commented Jul 12, 2017 •

edited

Loading

ianvernon commented Jul 14, 2017 •

edited

Loading