Skip to content

Note that packet capture now records every interface on a multi-interface pod #3064

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
caseydavenport wants to merge 2 commits into
base: main
Choose a base branch
from
+15 −1
Open

Note that packet capture now records every interface on a multi-interface pod #3064

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
936f773
Drop multi-interface pods from packet capture limitations
caseydavenport Oct 7, 2026
e92edc3
Show capturing one interface of a multi-interface pod
caseydavenport Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion calico-enterprise/observability/packetcapture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,6 @@ For a simple use case workflow, see [Faster troubleshooting of microservices, co
**Not supported**

- Capturing traffic from host networked pods or host endpoints
- Capturing traffic from pods with multiple interfaces
- Capturing traffic for pods running on Windows hosts

## How to
Expand Down Expand Up @@ -125,6 +124,20 @@ spec:
selector: k8s-app == "nginx"
```

**Example: One interface of a pod with multiple interfaces**

A capture records every interface its selector matches. On a pod with more than one interface, such as a Multus pod, each interface's workload endpoint carries the `projectcalico.org/network-interface` label with the interface name inside the pod. This example captures traffic only on the `net1` interface of pods with the label `app` equal to `vm`.

```yaml
apiVersion: projectcalico.org/v3
kind: PacketCapture
metadata:
name: sample-capture-net1
namespace: sample
spec:
selector: app == "vm" && projectcalico.org/network-interface == "net1"
```

**Example: All pods in a namespace, TCP traffic only**

This example captures traffic on all pods in the `sample` namespace, but only for TCP traffic.
Expand Down Expand Up @@ -251,6 +264,7 @@ Packet capture files are stored on the host-mounted volume used for calico nodes
`{namespace}/{packet capture resource name}`
- The active packet capture file is identified using the following schema:
`{workload endpoint name}_{host network interface}.pcap`
- A pod with more than one interface, such as a Multus pod, gets a separate capture file for each interface
- Rotated capture file names contain an index matching the rotation timestamp
- Packet capture files are deleted after the packet capture resource is deleted.

Expand Down
Loading