#TCPDUMP #NC and #K8S fun !!
This tutorial explains how to tunnel tcpdump
pcap traffic from a Kubernetes cluster back to a remote workstation.
Redirect output to stdout
In the first example, tcpdump
captures traffic to http port 80 and writes it to stdout (-w -
). The -U
makes sure the traffic is send immediately to the output (to avoid being buffered).
tcpdump -i any -n -U -w - port 80 >demo.pcap
Hit ctrl-c to stop the capture. We can now read the capture and no errors are displayed.
tcpdump -r demo.pcap
Redirect via netcat
Open a first terminal to capture some traffic. stdout is now redirected to netcat
tcpdump -i any -n -U -w - port 80 | nc 127.0.0.1 6666
In a second terminal we can redirect the stream to a file and in the meanwhile monitor the traffic
nc -l 6666 >demo.pcap
You can now read the capture
tcpdump -r demo.pcap
Redirect via SSH reverse tunneling
Create an SSH session with the host your planning to run tcpdump
ssh root@remote-host -R 6666:127.0.0.1:6666
And now run the capture
tcpdump -i any -n -U -w - port 80 | nc 127.0.0.1 6666
On the local machine you can redirect
nc -l 6666 >demo.pcap
and read the captured traffic
tcpdump -r demo.pcap
Apply previous concept in a Kubernetes cluster
This section will demonstrate that the techniques discussed will also work for pods (and containers). Although this is aimed at troubleshooting, it might also be an attack vector if a pod or cluster is breached
This example is based on a default commercially available managed Kubernetes cluster. Since SSH into the managed environment is not available, I opted for a variant of the Redirect via netcat example.
SSH into a reachable (for the cluster) Linux server:
ssh root@remote-host
nc -l 6666 >demo.pcap
Spin up a pod on a cluster
export KUBECONFIG=./cluster-kubeconfigdemo-dupe.yaml
kubectl run --rm -it --image xxradar/hackon demo -- bash
Inside the container
tcpdump -i any -n -U -w - port 80 | nc remote-host 6666 &
curl www.radarhack.com
On the remote-host you can now inspect the demo.pcap
file
tcpdump -r demo.pcap
For more advanced techniques on tcpdump
inside containers and pods, please checkout on https://medium.com/@xxradar
GitHub how-to-tcpdump-effectively-in-kubernetes-part-1
how-to-tcpdump-effectively-in-docker
Useful information about the SSH use-case can be found in
when-ssh-and-nc-meets-k8s-networking