Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-1379

DNS TCP flows have n/a values

XMLWordPrintable

    • False
    • None
    • False
    • OCPSTRAT-965 - DNS tracking improvements
    • NetObserv - Sprint 244
    • Important

      Description of problem:DNS TCP flows show up n/a values for DNS related columns

      Steps to Reproduce:

      1.Deploy latest downstream operator
2.Create flowcollector with DNSTracking enabled
3.Deploy pod running DNS queries on TCP by following the steps in https://issues.redhat.com/browse/NETOBSERV-1245 description 
4.Go to netflow-traffic page and filter on SrcPort 53, DstNamespace <podNS> and protocol TCP

      Actual results:

      Some flows have DNS Id, Latency, Response Code fields as n/a

      Expected results:

      All flows should have DNS Id, Latency, Response Code fields should have non-n/a values

      PTAL the screenshot below for reference

        1. Screenshot 2023-10-25 at 2.04.15 PM.png
          Screenshot 2023-10-25 at 2.04.15 PM.png
          457 kB
        2. Screenshot 2023-11-06 at 4.49.37 PM.png
          Screenshot 2023-11-06 at 4.49.37 PM.png
          443 kB
        3. tcp-dns.pcap
          1 kB

            [NETOBSERV-1379] DNS TCP flows have n/a values

            GitLab CEE Bot added a comment -

            CPaaS Service Account mentioned this issue in a merge request of netobserv-midstream / Network Observability Operator Midstream on branch network-observability-1.5.0-rhel-9_upstream_de8a35f8b06b8c50c4abe69ab3f0aefa:

            Updated 3 upstream sources

            GitLab CEE Bot added a comment - CPaaS Service Account mentioned this issue in a merge request of netobserv-midstream / Network Observability Operator Midstream on branch network-observability-1.5.0-rhel-9_ upstream _de8a35f8b06b8c50c4abe69ab3f0aefa : Updated 3 upstream sources

            Julien Pinsonneau added a comment -

            Merged FLP & Plugin PRs. Thanks for the team work !

            Julien Pinsonneau added a comment - Merged FLP & Plugin PRs. Thanks for the team work !

            GitLab CEE Bot added a comment -

            CPaaS Service Account mentioned this issue in a merge request of netobserv-midstream / Network Observability Operator Midstream on branch network-observability-1.5.0-rhel-9_upstream_6c2209686e7bf2e3ef609af092f9840f:

            Updated US source to: d69703f dbg DNS over TCP NA fields (#218)

            GitLab CEE Bot added a comment - CPaaS Service Account mentioned this issue in a merge request of netobserv-midstream / Network Observability Operator Midstream on branch network-observability-1.5.0-rhel-9_ upstream _6c2209686e7bf2e3ef609af092f9840f : Updated US source to: d69703f dbg DNS over TCP NA fields (#218)

            Amogh Rameshappa Devapura added a comment -

            Verified the new DNSErr column and only flows which has non-zero error has DNSId and DNSLatency values for DNS on TCP as well as UDP. Works as expected!

            Cluster details:

            • OCP: 4.13.0-0.nightly-2023-11-06-032945
            • NetObserv operator: v1.5.0
            • eBPF-agent: 9bed2e9
            • FLP: 02185c6
            • ConsolePlugin: 5e1c444

            Amogh Rameshappa Devapura added a comment - Verified the new DNSErr column and only flows which has non-zero error has DNSId and DNSLatency values for DNS on TCP as well as UDP. Works as expected! Cluster details: OCP: 4.13.0-0.nightly-2023-11-06-032945 NetObserv operator: v1.5.0 eBPF-agent: 9bed2e9 FLP: 02185c6 ConsolePlugin: 5e1c444

            Mohamed Mahmoud added a comment -

            not all TCP flows have DNS headers that is very clear when collect pcap file tcp-dns.pcapas u can see TCP packets during handshake don't include DNS headers and those the one shows as NA in the console

            users can use dns_id != 0 filter to avoid to ignore those entries

            Mohamed Mahmoud added a comment - not all TCP flows have DNS headers that is very clear when collect pcap file tcp-dns.pcap as u can see TCP packets during handshake don't include DNS headers and those the one shows as NA in the console users can use dns_id != 0 filter to avoid to ignore those entries

              mmahmoud@redhat.com Mohamed Mahmoud
              rhn-support-aramesha Amogh Rameshappa Devapura
              Amogh Rameshappa Devapura Amogh Rameshappa Devapura
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: