Lightning Talk: Troubleshooting Envoy K8s Containers with Ksniff
summary
Ksniff is a kubectl plugin that launches a privileged capture pod and opens Wireshark locally so packet captures come directly from a target container using the --container/dasc flag. Demonstrations show concrete signals: reset packets correlate with 503s, TCP retransmits and retransmission patterns indicate network congestion causing downstream 504s, and Wireshark fatal alerts reveal certificate expired or verify failed. Workflow works live but requires local Wireshark and cluster pod privileges.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:14Troubleshooting in distributed systems
- 0:51What is KFF
- 1:11K Sniff Command
- 1:34K Sniff Diagram
- 2:07Troubleshooting WiFishark Envoy
- 3:18Troubleshooting abnormal behavior
- 3:42Looking at Envoy logs
- 3:57Looking at WiFishark logs
- 4:11Looking at 504s
- 4:37Request timeout
- 4:47Conclusion
related talks
01h 25mCloud-Native Building Blocks: An Interactive Envoy Proxy Workshop
34mIt's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...
26mK8SNIff - End-to-End Encryption Till the Pod [A]
55mThe Hacker's Guide to Kubernetes
29mDebugging Envoy Tunnels: A Deep Dive
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
33mThree Surprising K8s Networking “Features” and How to Defend Against Them
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…