Live Packet Capture of a Pod in Kubernetes

gistfile1.txt

Summary:
Run tcpdump on a pod and then see that information through Wireshark locally on my machine.

Topology
--------
[laptop with wireshark] ------> [AKS Node] ------> [POD (tcpdump is here)]. 

##1. Create the fifo on your local machine (where wireshark will run)
   ```
   mkfifo /tmp/remote-capture.fifo
   ```

##2. Execute the following command to send traffic from within a POD to the stdout. This will then be redirected to the fifo locally
   ```
   kubectl exec < pod name > -- tcpdump -s 0 -n -w - -U -i eth0 not port 22 > /tmp/remote-capture.fifo
   ```

##3. Open Wireshark
   ```
   wireshark -kni /tmp/remote-capture.fifo
   ```