A kubectl plugin that utilize tcpdump and Wireshark to start a remote capture on any pod in yourKubernetes cluster.
You get the full power of Wireshark with minimal impact on your running pods.
When working with micro-services, many times it's very helpful to get a capture of the networkactivity between your micro-service and it's dependencies.
ksniff use kubectl to upload a statically compiled tcpdump binary to your pod and redirecting it'soutput to your local Wireshark for smooth network debugging experience.
Ksniff isn't production ready yet, running ksniff for production workloads isn't recommended at this point.
Installation via krew (https://github.com/GoogleContainerTools/krew)
kubectl krew install sniff
For manual installation, download the latest release package, unzip it and use the attached makefile:
unzip ksniff.zip
make install
Requirements:
Compiling:
linux: make linux
windows: make windows
mac: make darwin
To compile a static tcpdump binary:
make static-tcpdump
kubectl < 1.12:
kubectl plugin sniff <POD_NAME> [-n <NAMESPACE_NAME>] [-c <CONTAINER_NAME>] [-i <INTERFACE_NAME>] [-f <CAPTURE_FILTER>] [-o OUTPUT_FILE] [-l LOCAL_TCPDUMP_FILE] [-r REMOTE_TCPDUMP_FILE]
kubectl >= 1.12:
kubectl sniff <POD_NAME> [-n <NAMESPACE_NAME>] [-c <CONTAINER_NAME>] [-i <INTERFACE_NAME>] [-f <CAPTURE_FILTER>] [-o OUTPUT_FILE] [-l LOCAL_TCPDUMP_FILE] [-r REMOTE_TCPDUMP_FILE]
POD_NAME: Required. the name of the kubernetes pod to start capture it's traffic.
NAMESPACE_NAME: Optional. Namespace name. used to specify the target namespace to operate on.
CONTAINER_NAME: Optional. If omitted, the first container in the pod will be chosen.
INTERFACE_NAME: Optional. Pod Interface to capture from. If omitted, all Pod interfaces will be captured.
CAPTURE_FILTER: Optional. specify a specific tcpdump capture filter. If omitted no filter will be used.
OUTPUT_FILE: Optional. if specified, ksniff will redirect tcpdump output to local file instead of wireshark. Use '-' for stdout.
LOCAL_TCPDUMP_FILE: Optional. if specified, ksniff will use this path as the local path of the static tcpdump binary.
REMOTE_TCPDUMP_FILE: Optional. if specified, ksniff will use the specified path as the remote path to upload static tcpdump to.
Use --image
and --tcpdump-image
flags to override the default container images and use your own e.g (docker):
kubectl plugin sniff <POD_NAME> [-n <NAMESPACE_NAME>] [-c <CONTAINER_NAME>] --image <PRIVATE_REPO>/docker --tcpdump-image <PRIVATE_REPO>/tcpdump
To reduce attack surface and have small and lean containers, many production-ready containers runs as non-privileged useror even as a scratch container.
To support those containers as well, ksniff now ships with the "-p" (privileged) mode.When executed with the -p flag, ksniff will create a new pod on the remote kubernetes cluster that will have access to the node docker daemon.
ksniff will than use that pod to execute a container attached to the target container network namespaceand perform the actual network capture.
By default ksniff will attempt to start a local instance of the Wireshark GUI. You can integrate with other toolsusing the -o -
flag to pipe packet cap data to stdout.
Example using tshark
:
kubectl sniff pod-name -f "port 80" -o - | tshark -r -
More than welcome! please don't hesitate to open bugs, questions, pull requests
Wireshark may show UNKNOWN
in Protocol column. TShark may report the following in output:
tshark: The standard input contains record data that TShark doesn't support.
(pcap: network type 276 unknown or unsupported)
This issue happens when using an old version of Wireshark or TShark to read the pcap created by ksniff. Upgrade Wireshark or TShark to resolve this issue. Ubuntu LTS versions may have this problem with stock package versions but using the Wireshark PPA will help.
使用ksniff分析k8s pod的抓包分析 ksniff是一个kubectl插件,利用tcpdump和Wireshark对Kubernetes集群中的任何pod进行远程捕获。 可以得到Wireshark的全部功能,而对你正在运行的pods影响最小。 介绍 当使用微服务时,很多时候获取微服务和它的依赖之间的网络活动的捕获是非常有用的。 ksniff使用kubectl上传静态编译的tcpdump二进