How to use wireshark with K8S

tcp_dump_wireshark.md

How to use Wireshark to troubleshoot remote K8S containers

Open a shell into your container

local:~$ kubectl exec -it <pod> -n <namespace> -c <container> sh

Install tcpdump

root@container:/# apt install tcpdump -y

Monitor traffic with tcpdump. Complete capture with ctrl-c when done.

root@container:/# tcpdump -i any -w /tmp/capture_data.pcap -A

Export captured traffic from container

# leave the container
root@container:/# exit
# copy the capture data locally
local:~$ kubectl cp <pod>:/tmp/capture_data.pcap ~/capture_data.pcap

Load captured data into Wireshark