netshoot VS inspektor-gadget

Now, let's use netshoot, a Docker image equipped with a set of networking troubleshooting tools that can be used for Docker networking.

nicolaka/netshoot for sure. having a preloaded array of networking troubleshooting tools in an image for kubernetes debugging is a godsend.

First off, it seems like getting tcpdump or Wireshark to capture from the container network and dumping to a file will take some extra steps. (A lot of blog posts seem to recommend this Github project - https://github.com/nicolaka/netshoot)

Some hints how to debug such problems in the future: 1. ufw drops/rejections are logged (use dmesg to view them) 2. wireshark shows all connection attempts, even those that are blocked by firewall 3. ss or netstat shows if the server is actually listening for connections 4. netshoot allows to enter docker container network namespace and do pings, curl or telnet from there

You can try using https://www.inspektor-gadget.io/ You can try either, top tcp, trace network-graph or trace tcp gadget. It's a CNCF sandbox project and it's kubernetes native so I think this should work.

This works really well https://github.com/inspektor-gadget/inspektor-gadget/blob/main/docs/gadgets/advise/network-policy.md

Link to GitHub Repository

Inspector gadget is a tool designed to introspect and debug Kubernetes applications using eBPF.

I found this tool: https://github.com/kinvolk/inspektor-gadget great if you want to have a detailed debugging for running pods e.g all exec system calls or trace tcp connections etc.

All namespaces should have NetworkPolicy. Interactions between namespaces should be limited to NetworkPolicy following least privileges principles (Inspektor Gadget)

The team behind traceloop has integrated it with the Inspektor Gadget project, so you can run traceloop on the K8s platform using kubectl. See the demos in Inspektor Gadget - How to use and, if you like, try it on your own.