Sniff Kubernetes Pod requests and headers using tpcdump
When your fancy observability tools have failed you there’s still trusty tpcdump
The was done on Ubuntu. YMMV on other distros.
Exec into a pod
1 | kubectl exec -it my-pod-name sh |
Run
1 | cat /sys/class/net/eth0/iflink |
It should return a number, the container eth id
Now run
1 | kubectl describe po my-pod-name | grep Node |
To find out the node it’s running on
SSH into the node then run below to find the eni id
1 | ip link | grep 588 |
Now use tcpdump to sniff the requests coming in
1 | tcpdump -A -i eni89aabc12345 |
To capture a specific header
1 | tcpdump -A -i eni89aabc12345 | grep -i X-Real-IP -C 5 |
