Docs

Volcengine Kubernetes Engine

Full stack observation

Capturing network packets

Cloud-native observability of Volcano Engine (full-stack observability) can capture network packets on the specified workload or pod, which facilitates troubleshooting of container networks. This topic describes how to configure the network packet capture feature.

Background information

Network packet capture is an important troubleshooting method for complex container environments. If you perform network packet analysis on specified workloads or pods, the following scenario issues can be effectively resolved:

Network troubleshooting: When network issues occur, packet capture can help identify the issues. Packets on different nodes are analyzed to troubleshoot connections or configurations.

Security analysis: Security teams can use packet capture to monitor network traffic and identify potential security threats, such as DDoS attacks and ARP spoofing.

Performance optimization: Network traffic is analyzed to identify performance issues, such as requests with long response times or unnecessary repeated requests. This provides optimization solutions to specific performance issues.

Prerequisites

TOS has been activated, and a TOS bucket has been created in the same region as the target VKE cluster. For details, see Creating buckets.

Cloud-native observability has been enabled. For details, see Enabling observability.

Full-stack observability has been enabled. For details, see Enabling full-stack observability.

The microscope agent in full-stack observability has been upgraded to version 1.10.0 or later.

Procedure

Step 1: Configure packet capture

In the left navigation bar, click Cluster.

On the cluster list page, click the target cluster.

In the left navigation bar of the cluster management page, click Monitoring center > Packet capture. On the page that appears, click Packet capture configuration to configure the TOS that corresponds to the packet capture task.

Click Enable to enable the TOS configuration and specify the parameters of the TOS bucket.

Parameters	Description
Bucket name	Select the created TOS bucket from the drop-down list.
Subdirectory	Specify the path where the packet capture results are saved in the TOS bucket. If this parameter is not specified, the path is /.

Click Confirm.

Step 2: Create a packet capture task

Directly creating a packet capture task

You can perform the following steps to directly configure a packet capture task on the Network packet capture page:

In the left navigation bar of the cluster management page, click Monitoring center > Packet capture. On the page that appears, click Create packet capture task, and configure the details of the packet capture task.

Basic information

Parameters
Description
Name
The name of the packet capture task.
Description
You can add a description for the packet capture task as needed. This parameter is left empty by default.

Targets

Parameters	Description
Target	Configure the targets of the packet capture task. You can configure multiple packet capture targets for the same packet capture task.
Namespace	Select the namespace where the target of the packet capture task is located.
Workload type	Select the type of packet capture target. Valid values: Deployment StatefulSet DaemonSet Pod
Workload name	Select the target workload of the packet capture task.
Pods	Select the target pod of the packet capture task.
Network interface	Configure a network interface card (NIC) for the packet capture target, such as eth0. The default value is any, which indicates all NICs.
Maximum packet length	Specify the maximum length of the packet. The value must be an integer. Units can be KB, MB, or GB. The packet can be up to 2 GB in length.
Duration	Specify the duration of the packet capture task. The value must be an integer. Unit: seconds. If you have not configured a packet capture duration, you need to manually stop the packet capture task.
Rules	Configure the packet capture rules. Protocol: Configure the packet capture protocol. Valid values: Any, TCP, UDP, and ICMP. Source addresses: Configure the source address for packet capture. You can configure a single IP address, such as 192.168.1.10, multiple IP addresses that need to be separated by \|, such as 192.168.1.10\|192.168.1.20, or a CIDR block, such as 192.168.1.0/24. Source port: Configure the source port number for packet capture. You can configure a single port number, such as 80. If this parameter is left empty, it indicates all ports are used, which are 1 to 65535. Target addresses: Configure the target address for packet capture. You can configure a single IP address, such as 192.168.1.10, multiple IP addresses that need to be separated by \|, such as 192.168.1.10\|192.168.1.20, or a CIDR block, such as 192.168.1.0/24. Target port: Configure the target port number for packet capture. You can configure a single port number, such as 80. If this parameter is left empty, it indicates all ports are used, which are 1 to 65535.

Click Confirm to start capturing packets.

Creating tasks by using cluster topologies

You can perform the following steps to create a packet capture task by using network topologies on the Topology page:

In the left navigation bar of the cluster management page, click Monitoring center > Cluster topology. View the topology chart of workload resources.

In the topology, find the target line between two workload nodes, move the pointer over the line, and then click Network packet capture in the pop-up overview window. Then, you are redirected to the Network packet capture page and configure the packet capture task. For a specific packet capture configuration, see Directly creating packet capture tasks.

Validating results

After the packet capture task is configured, the system starts capturing packets based on the configurations.

When the task state changes to Finish, it indicates that the packet capture task is complete. Click View details in the Actions column to view the details of the packet capture task. Click Download in the Actions column that corresponds to the target packet capture task to download the packet capture file in pcap format to your on-premises computer.

tip

You can use the Wireshark tool on your on-premises computer to analyze the packet capture file in pcap format.

Last updated: 2026.07.24 11:19:43

Parameters	Description
Name	The name of the packet capture task.
Description	You can add a description for the packet capture task as needed. This parameter is left empty by default.