Is it possible to capture PCAP files in a kubernetes installation?

[hammadahmed1985]

I can see tracee allows capturing of PCAP files but I haven't been able to find any instructions on how this can be done in a kubernetes cluster. I was wondering if that is even possible at the moment? If not, then are there any plans of getting this feature or if there might be a work-around?

[josedonizetti]

@hammadahmed1985 you can use it, we don't directly support it on the config file, but you could edit the tracee daemonset and add --capture network, for example, and tracee would generate pcaps from the network on the given host, though keep in mind:

1. capture is taxing, so might not be the best for production
2. tracee will store it inside its own pod /tmp/tracee/out, with big file as k8s clusters see a lot of traffic

[hammadahmed1985]

Thanks @josedonizetti