<p>I'm attempting to get a view in Wireshark of live network traffic in one of my Kubernetes pods.  In plain old Docker, I was able to run this:</p>

<p><code>docker run --rm --net=container:app_service_1 crccheck/tcpdump -i any --immediate-mode -w - | wireshark -k -i -</code></p>

<p>This spins up a simple container that runs <code>tcpdump</code> with the arguments shown, and pipes the packet captures in pcap format to stdout (the <code>-w -</code> argument).  This output is then piped to Wireshark running on my host machine, which displays the packets as they arrive.</p>

<p><strong>How do I do something similar in Kubernetes?</strong>  </p>

<p>I've tried applying a patch as follows:</p>

<pre><code>  template:
    spec:
      containers:
        - name: tcpdumper
          image: crccheck/tcpdump
          args: ["-i", "any", "--immediate-mode", "-w", "-"]
          tty: true
          stdin: true
</code></pre>

<p>And I apply this by running <code>k attach -it app-service-7bdb7798c5-2lr6q | wireshark -k -i -</code></p>

<p>But this doesn't seem to work; Wireshark starts up but it immediately shows an error:</p>

<p><code>Data written to the pipe is neither in a supported pcap format nor in pcapng format</code></p>

<p>I haven't used k8s a lot, but the docker run gets the entire clean stdout, while I get the impression that k attach doesn't.</p>

<p>I don't think that kubectl has an equivalent of docker run, that gives you clean stdout, but you might be able to do something with kubectl exec.</p>

<p>A possible test would be to redirect the output to a file, and see if it's valid output for the command you're running, and that there's nothing unexpected there.</p>
