---
title: Secondary networks
---

# Secondary networks {#network-observability-secondary-networks}

You can configure the Network Observability Operator to collect and enrich network flow data from secondary networks, such as `SR-IOV` and `OVN-Kubernetes`.

## Prerequisites {#network-observability-secondary-network-prerequisites_network-observability-secondary-networks}

- Access to an OpenShift Container Platform cluster with an additional network interface, such as a secondary interface or an L2 network.

## Configuring monitoring for SR-IOV interface traffic {#network-observability-SR-IOV-config_network-observability-secondary-networks}

Configure the `FlowCollector` resource to monitor traffic on Single Root I/O Virtualization (SR-IOV) device by setting the `spec.agent.ebpf.privileged` field to `true`, which enables the eBPF agent to monitor other network namespaces.

The eBPF agent monitors other network namespaces in addition to the host network namespaces, which are monitored by default. When a pod with a virtual functions (VF) interface is created, a new network namespace is created. With `SRIOVNetwork` policy `IPAM` configurations specified, the VF interface is migrated from the host network namespace to the pod network namespace.

**Prerequisites**

- Access to an OpenShift Container Platform cluster with a SR-IOV device.
- The `SRIOVNetwork` custom resource (CR) `spec.ipam` configuration must be set with an IP address from the range that the interface lists or from other plugins.

**Procedure**

1. In the web console, navigate to **Ecosystem** → **Installed Operators**.
2. Under the **Provided APIs** heading for the **NetObserv Operator**, select **Flow Collector**.
3. Select **cluster** and then select the **YAML** tab.
4. Configure the `FlowCollector` custom resource. A sample configuration is as follows:

   ```yaml {title="Configure FlowCollector for SR-IOV monitoring"}
   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     namespace: netobserv
     deploymentModel: Service
     agent:
       type: eBPF
       ebpf:
         privileged: true
   ```

   - The `spec.agent.ebpf.privileged` field value must be set to `true` to enable SR-IOV monitoring.

**Additional resources**
{._additional-resources}

- [Configuring an SR-IOV network device](/openshift-docs-markdown/networking/hardware_networks/configuring-sriov-device#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device)

## Configuring virtual machine (VM) secondary network interfaces for Network Observability {#network-observability-virtualization-config_network-observability-secondary-networks}

Configure the `FlowCollector` to monitor VM secondary network traffic by setting the eBPF agent to `privileged` mode and defining the indexing for secondary networks, enabling the capture and enrichment of flows from OpenShift Virtualization.

Network flows coming from VMs that are connected to the default internal pod network are automatically captured by network observability.

**Procedure**

1. Get information about the virtual machine launcher pod by running the following command. This information is used in Step 5:

   ```terminal
   $ oc get pod virt-launcher-<vm_name>-<suffix> -n <namespace> -o yaml
   ```

   ```yaml
   apiVersion: v1
   kind: Pod
   metadata:
     annotations:
       k8s.v1.cni.cncf.io/network-status: |-
         [{
           "name": "ovn-kubernetes",
           "interface": "eth0",
           "ips": [
             "10.129.2.39"
           ],
           "mac": "0a:58:0a:81:02:27",
           "default": true,
           "dns": {}
         },
         {
           "name": "my-vms/l2-network",
           "interface": "podc0f69e19ba2",
           "ips": [
             "10.10.10.15"
           ],
           "mac": "02:fb:f8:00:00:12",
           "dns": {}
         }]
     name: virt-launcher-fedora-aqua-fowl-13-zr2x9
     namespace: my-vms
   spec:
   #  ...
   status:
   #  ...
   ```

   where:

   `name`
   :   Specifies the name of the secondary network.

   `interface`
   :   Specifies the network interface of the secondary network.

   `ips`
   :   Specifies the list of IP addresses used by the secondary network.

   `mac`
   :   Specifies the MAC address used for the secondary network.
2. In the web console, navigate to **Ecosystem** → **Installed Operators**.
3. Under the **Provided APIs** heading for the **NetObserv Operator**, select **Flow Collector**.
4. Select **cluster** and then select the **YAML** tab.
5. Configure `FlowCollector` based on the information you found from the additional network investigation:

   ```yaml
   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     agent:
       ebpf:
         privileged: true
     processor:
       advanced:
         secondaryNetworks:
         - index:
           - MAC
           name: my-vms/l2-network
   # ...
   ```

   where:

   `spec.agent.ebpf.privileged`
   :   Specifies that the eBPF agent runs in `privileged` mode, which is required to collect flows from secondary network interfaces on virtual machine launcher pods.

   `spec.processor.advanced.secondaryNetworks.index`
   :   Specifies the fields to use for indexing the virtual machine launcher pods. It is recommended to use the `MAC` address as the indexing field to get network flows enrichment for secondary interfaces. If you have overlapping MAC addresses between pods, then additional indexing fields, such as `IP` and `Interface`, can be added to ensure accurate enrichment.

   `MAC`
   :   Specifies the MAC address as an indexing field value. Add `MAC` to the `index` field list if your additional network information includes a MAC address.

   `spec.processor.advanced.secondaryNetworks.name`
   :   Specifies the name of the secondary network as found in the `k8s.v1.cni.cncf.io/network-status` annotation of the virtual machine launcher pod. The format is typically `<namespace>/<network_attachment_definition_name>`.

**Verification**

1. Observe VM traffic:

   1. Navigate to the **Network Traffic** page.
   2. Filter by **Source** IP using your virtual machine IP found in `k8s.v1.cni.cncf.io/network-status` annotation.
   3. View both **Source** and **Destination** fields, which should be enriched, and identify the VM launcher pods and the VM instance as owners.