查看需要抓去的pod所在宿主机
root@arm:~# kubectl get pods -A -owide # 这里查看nginx的流量
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
container-registry registry-9dffc8bcf-k9fmr 1/1 Running 0 13m 10.1.86.48 arm <none> <none>
default nginx-5b6fb6dd96-dzt4c 1/1 Running 0 9m32s 10.1.86.43 arm <none> <none>
kube-system coredns-9b8997588-th4xx 0/1 CrashLoopBackOff 5 13m 10.1.86.49 arm <none> <none>
kube-system dashboard-metrics-scraper-687667bb6c-5lrjl 1/1 Running 0 13m 10.1.86.44 arm <none> <none>
kube-system heapster-v1.5.2-785fc64dc4-r9bsg 4/4 Running 0 13m 10.1.86.50 arm <none> <none>
kube-system hostpath-provisioner-7c48f5d96d-p5l2q 1/1 Running 0 13m 10.1.86.47 arm <none> <none>
kube-system kubernetes-dashboard-5c848cc544-jcqbd 1/1 Running 0 13m 10.1.86.46 arm <none> <none>
kube-system monitoring-influxdb-grafana-v4-5dc6b74bf-cjcw7 2/2 Running 0 13m 10.1.86.45 arm <none> <none>
登陆宿主机查看容器id
root@arm:~# docker ps |grep nginx
3b23a2cbd4a0 **nginx** "/docker-entrypoint.…" 7 minutes ago Up 7 minutes k8s_**nginx**_**nginx**-5b6fb6dd96-dzt4c_default_bda52b20-ecbf-4196-8246-3ce2f588c3d5_0
4fc7a9de84cc k8s.gcr.io/pause:3.1 "/pause" 7 minutes ago Up 7 minutes k8s_POD_**nginx**-5b6fb6dd96-dzt4c_default_bda52b20-ecbf-4196-8246-3ce2f588c3d5_0
获取容器pid
root@arm:~# docker inspect -f {{.State.Pid}} 3b23a2cbd4a0
1731268
使用nsenter进入容器命名空间
root@arm:~# nsenter --target 1731268 -n
root@arm:~# ifconfig # 查看eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 8950
inet 10.1.86.43 netmask 255.255.255.0 broadcast 0.0.0.0
ether 46:83:34:ea:4d:11 txqueuelen 0 (Ethernet)
RX packets 60 bytes 5214 (5.2 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1 bytes 42 (42.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
使用tcpdump抓取流量包
root@arm:~# tcpdump -i eth0 port 80 -w nginx.cap
查看结果
参考
nsenter
tcpdump