--- title: How to Upload Kubernetes Packet Captures to S3 With Isopcap description: Isopcap v0.7.0 adds an opt-in rclone sidecar that uploads completed Kubernetes packet captures to any S3-compatible bucket. Each capture is sealed with an... canonical: https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Upload Kubernetes Packet Captures to S3 With Isopcap | daily.dev og:description: Isopcap v0.7.0 adds an opt-in rclone sidecar that uploads completed Kubernetes packet captures to any S3-compatible bucket. Each capture is sealed with an... og:url: https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x og:image: https://api.daily.dev/og/posts/Y3edvDK4x.png og:image:alt: How to Upload Kubernetes Packet Captures to S3 With Isopcap og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Upload Kubernetes Packet Captures to S3 With Isopcap **[Isovalent](https://daily.dev/sources/isovalent)** · 9 min read · 0 upvotes · 0 comments ## Summary Isopcap v0.7.0 adds an opt-in rclone sidecar that uploads completed Kubernetes packet captures to any S3-compatible bucket. Each capture is sealed with an atomic manifest.json that only appears once every pcap file is uploaded, so nothing downstream reads a half-written trace. The sidecar runs 'rclone check --one-way' to verify uploads before deleting local files, reclaiming node disk space. In the example, a capture against a shop workload recorded 1734 packets with no drops, and a teammate pulled the trace from the bucket with s3cmd to find a TCP reset explaining intermittent HTTP drops. The release also adds a documented OpenShift install path. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Isopcap upload Kubernetes packet captures to S3 storage? Isopcap v0.7.0 adds an opt-in rclone-based sidecar container that watches for completed manifest.json files and copies the associated pcap objects to any S3-compatible bucket. It runs 'rclone check --one-way' to verify every object arrived intact, then deletes the local copy from the node, reclaiming disk space only after the upload is confirmed. _Teams wiring up Kubernetes packet capture pipelines track releases like this one on daily.dev._ ### How do I know a Kubernetes packet capture file is complete and safe to read? Check for the presence of manifest.json in the capture's directory or bucket location. The agent writes this manifest last, only after every pcap file for that node's capture is finished, so a running or partially written capture has no manifest yet. Its appearance in object storage guarantees the whole capture, including packet counts and file sizes, is present and readable. _Developers debugging distributed capture pipelines keep tabs on patterns like this via daily.dev._ ### Why would a TCP connection show intermittent HTTP drops despite returning 200 OK responses? A packet trace can reveal a TCP reset (RST flag) occurring alongside an otherwise healthy 200 OK response, which explains intermittent drops that application logs alone don't surface. Capturing traffic at the pod level with tools like Isopcap and inspecting the PCAPng file with tcpdump or Wireshark exposes this kind of transport-layer evidence directly. _Engineers chasing flaky network symptoms find packet-level debugging writeups like this through daily.dev._ ## Similar posts on daily.dev - [Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations](https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2) · Isovalent · 1 upvotes · 0 comments - [Capturing Network Packets in Kubernetes](https://daily.dev/posts/capturing-network-packets-in-kubernetes-aoknueaaw) · Mercari Engineering · 1 upvotes · 0 comments - [Kubernetes disaster recovery: Guidance from three reproducible failure scenarios](https://daily.dev/posts/kubernetes-disaster-recovery-guidance-from-three-reproducible-failure-scenarios-i6ictrsv0) · CNCF · 10 upvotes · 1 comments - [S3 Streamable Backup: Direct-to-Cloud Backups for Manticore Search](https://daily.dev/posts/s3-streamable-backup-direct-to-cloud-backups-for-manticore-search-8xagytblq) · Manticore · 3 upvotes · 0 comments - [The Hackathon Fix That Cut Our Storage Costs by 93%](https://daily.dev/posts/the-hackathon-fix-that-cut-our-storage-costs-by-93--fwfdp2gyw) · Cast AI · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#aws-s3](https://daily.dev/tags/aws-s3) [View this post on daily.dev](https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Upload Kubernetes Packet Captures to S3 With Isopcap","url":"https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x"},"datePublished":"2026-10-29T07:30:13.841Z","dateModified":"2026-10-29T07:32:12.999Z","description":"Isopcap v0.7.0 adds an opt-in rclone sidecar that uploads completed Kubernetes packet captures to any S3-compatible bucket. Each capture is sealed with an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/575583060b763dbcec86d5bf36d5c5bf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/575583060b763dbcec86d5bf36d5c5bf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Isovalent","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Isovalent","logo":"https://media.daily.dev/image/upload/s--aJv8XyPY--/f_auto/v1716188539/logos/isovalent","url":"https://daily.dev/sources/isovalent"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,aws-s3","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Isovalent","item":"https://daily.dev/sources/isovalent"},{"@type":"ListItem","position":3,"name":"How to Upload Kubernetes Packet Captures to S3 With Isopcap"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-upload-kubernetes-packet-captures-to-s3-with-isopcap-y3edvdk4x#faq","mainEntity":[{"@type":"Question","name":"How does Isopcap upload Kubernetes packet captures to S3 storage?","acceptedAnswer":{"@type":"Answer","text":"Isopcap v0.7.0 adds an opt-in rclone-based sidecar container that watches for completed manifest.json files and copies the associated pcap objects to any S3-compatible bucket. It runs 'rclone check --one-way' to verify every object arrived intact, then deletes the local copy from the node, reclaiming disk space only after the upload is confirmed. Teams wiring up Kubernetes packet capture pipelines track releases like this one on daily.dev."}},{"@type":"Question","name":"How do I know a Kubernetes packet capture file is complete and safe to read?","acceptedAnswer":{"@type":"Answer","text":"Check for the presence of manifest.json in the capture's directory or bucket location. The agent writes this manifest last, only after every pcap file for that node's capture is finished, so a running or partially written capture has no manifest yet. Its appearance in object storage guarantees the whole capture, including packet counts and file sizes, is present and readable. Developers debugging distributed capture pipelines keep tabs on patterns like this via daily.dev."}},{"@type":"Question","name":"Why would a TCP connection show intermittent HTTP drops despite returning 200 OK responses?","acceptedAnswer":{"@type":"Answer","text":"A packet trace can reveal a TCP reset (RST flag) occurring alongside an otherwise healthy 200 OK response, which explains intermittent drops that application logs alone don't surface. Capturing traffic at the pod level with tools like Isopcap and inspecting the PCAPng file with tcpdump or Wireshark exposes this kind of transport-layer evidence directly. Engineers chasing flaky network symptoms find packet-level debugging writeups like this through daily.dev."}}]} ```