Capturing Network Packets in Kubernetes

Mercari's Network team shares two methods for capturing network packets in Kubernetes environments. The primary approach uses Ephemeral Containers with tcpdump to capture unencrypted traffic at the pod level, enabling developers to self-service debug without node access. This method works well with Istio service mesh by capturing on all interfaces to see plaintext traffic. A secondary node-level approach using GKE SSH and CoreOS Toolbox is available for platform teams investigating node-wide issues, though it only captures encrypted traffic. The procedures include specific kubectl commands, permission requirements, and file retrieval steps designed for production troubleshooting.