Kubernetes eBPF Traffic Analysis With Kubeshark: Must have tool for DevOps/SRE engineers

[@CloudNativeSkunkworks]

How often do you use traffic analysis to debug issues?

[@farzadmf]

Seems like a super useful tool, nice UI and everything

[@CloudNativeSkunkworks]

Yeah, I think they took the best bits from wireshark and made it more reactive

[@farzadmf]

They sure did

[@S007001]

Indeed a 'life-saver' tool to debug complex networking issues :) Good explanation !!

[@CloudNativeSkunkworks]

Glad it was helpful!

[@dirien]

Great video Alex, as usual! Love Kubeshark!

[@CloudNativeSkunkworks]

Thanks for watching, I appreciate it! And yes it rocks

[@DiogoBaeder]

Awesome tool and demo, man! Thanks!

[@AbhishekVeeramalla]

Nice and simple explanation :) . Let me know if you are interested in a collaboration video.

[@CloudNativeSkunkworks]

That could be a lot of fun!

[@milenkomarkovic]

Really great video Alex!

[@CloudNativeSkunkworks]

Thank you!

[@kolloktn]

On my setup the save button doesn’t show up.. something else kubeshark didn’t detect the ZMQ traffic so I am wondering if the pcap file would contain any and loading it in wireshark would help

[@elabeddhahbi3301]

thank you that was really informative

[@CloudNativeSkunkworks]

Glad it was helpful!

[@manojkanjookaran7476]

How do I access the kubeshark dashboard outside the cluster

[@alixak4304]

My issue with importing K8s PCAP files to Wireshark is that Wireshark is unable to resolve the internal DNS names of the Kuebrentes services. I tried to port-forward the kuebrnetes DNS server and adding it to Wireshark config, but didn't work. It's inconvenient to to check the DNS entry for each IP.

[@CloudNativeSkunkworks]

That's a fair point, I suspect you could forward coreDNS locally though to make the resolution work - but it's not a 'out of the box' experience

[@tanishmahajan411]

How can i use Kubeshark in eks cluster?

[@zaynkhan464]

Is it possible to run on multi node remote kubernetes cluster?

[@CloudNativeSkunkworks]

Absolutely, that's how I was running it - the cluster wasn't on my local machine, instead it uses the KUBECONFIG to connect whatever cluster you're running

[@TheALEXiSounds]

I'd love to use Kubeshark but their payment model kinda makes it not possible. Free model only accounts for 2 node clusters, which in todays age, is pretty much unrealistic.