hubble VS ksniff

Since we installed Hubble on the cluster, Let’s check its cool UI and see how the traffic flows between the pods. To do so, let’s run:

This doesn’t just provide improved operational visibility - it’s incredibly beneficial to network security engineers. For instance, if Cilium is unable to communicate with core components such as ‘Hubble,’ this will show-up in the connectivity test.

It may be we could further optimize in some way, but in our testing we didn't find the streaming or EBPF based tables to work all that well for our purposes in osquery. This tool seems more promising for logging this sort of activity: https://github.com/cilium/hubble. We're focused on K8s visibility but this could replace all of our Linux Auditing level logging if it works well.

Cilium team also offers Hubble (yes, the name is the same as the famous far space crawling telescope's one, but for clouds), which is a fully distributed networking and security observability platform for cloud native workloads. Hubble is open source software and built on top of Cilium and eBPF to enable deep visibility into the communication and behavior of services as well as the networking infrastructure in a completely transparent manner.

However, if you look at projects like Cilium Hubble and Istio Galley, you can see that you not only get all the instrumentation to manage this stuff out of the box, but you also get observability into the health of your pods and fine-grained visibility that you won’t get with traditional tools.

CNI plugins like Cilium

so probably the right way is to use some tool like that (ksniff) or setup a sidecar container. But I am still curious to why I get the above error.

I've used https://github.com/eldadru/ksniff with success. Recently on this sub Kubeshark was also mentioned.

Link to GitHub Repository

There also is https://github.com/eldadru/ksniff which starts wireshart GUI

I have used Ksniff as a kubectl plugin that act as a "Wireshark tool" for containers https://github.com/eldadru/ksniff

I've found ksniff useful for monitoring Kubernetes traffic with wireshark: https://github.com/eldadru/ksniff

KSniff https://github.com/eldadru/ksniff lets you do full packet capture.

ksniff - known as sniff is a tool for debugging and capturing networking data. It's able to attach to a pod and using tcpdump to forward networking data to your local Wireshark. This tool also works pretty well with tshark - the command-line version of Wireshark.

Install ksniff - https://github.com/eldadru/ksniff#installation