1

Since the pods share the same subnet, is it possible that one pod can sniff the network packets of other pods? Please explain the reason.

Note: I created 3 pods in the same namespace, on one pod I ran tcpdump to sniff the packets, and then made a http request from another pod to a nginx pod. There were no results in the tcpdump.

1

1 Answer 1

1

This is not something anyone can answer. Kubernetes doesn't dictate what network gets used (it just uses it).

Depending on the actual network plugin being used and whether that has something like access control restrictions or other security features limiting communication.

By default, Kubernetes allows inter-pod communication in the same namespace. And restricts it (by using a separate network address) between namespaces. If you know the address, though. Typically, you can connect.

The network model is implemented by the container runtime on each node. The most common container runtimes use Container Network Interface (CNI) plugins to manage their network and security capabilities. Many different CNI plugins exist from many different vendors. Some of these provide only basic features of adding and removing network interfaces, while others provide more sophisticated solutions, such as integration with other container orchestration systems, running multiple CNI plugins, advanced IPAM features etc. documentation source

As for the results you saw… unless you have a network (card) that can operate in promiscuous mode (capture all traffic mode). It will only see traffic coming to or from that node.

This means pod three won't see any traffic between pod one and pod two.
Consider using a sidecar for the capture. Those share the IP of the pod they're on.

2
  • Darn. Yes. swapped the two words 4 times during writing. Thanks, I did an edit fixing that.
    – LvB
    Commented Aug 30, 2023 at 9:46
  • Just to add, even in promiscuous mode the NIC will only see traffic within the same collision domain. I believe in modern cloud VPCs (e.g. GKE) each node is effectively within its own collision (and broadcast) domain, so I think at best you’d only see traffic to/from other pods running on the same node. The cloud providers generally provide a supported mechanism for packet inspection, eg packet mirroring. Commented Apr 9 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .