ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] kubernetes live tcpdump using wireshark

Date Prev · Date Next · Thread Prev · Thread Next
From: luke devon <luke_devon@xxxxxxxxx>
Date: Wed, 3 Nov 2021 15:02:13 +0000 (UTC)
Hi, 

I want to capture kubernetes live tcpdump using wireshark. 
My workstation is Windows 10.

from the Win 10 machine, I have access to kubernetes deploy nodes and control nodes. but the next layer, the PODs are unable to access directly. So the requirement is , taking live wireshark traces of those PODs. 

How can it be done? can we still use plink from the windows 10 machine? 

As I think, we need to create a ssh tunnel in between control nodes and PODs. Is it possible to take traces without making such changes for the cluster?

Win 10 --> Kubernetes Control node ---> PODs / Containers


Thanks in advance, 
Luke