Isopcap is a new Kubernetes-native packet capture product from Isovalent, part of the Isovalent Enterprise Platform. It lets platform teams define packet captures declaratively using a PacketCapture custom resource, targeting pods by label selectors, filtering with BPF, and bounding captures by duration or file size. The Isopcap agent runs as a DaemonSet, enters pod network namespaces, and writes standard PCAPng output without requiring SSH access to nodes, sidecar injection, or workload restarts. It supports primary and secondary interfaces (Multus, DRA, SR-IOV), pre-trigger rolling buffers for capturing traffic around intermittent events, RSPAN live streaming to Wireshark or tshark, file rotation, and per-node status via PacketCaptureNodeStatus. The goal is to bring packet-level evidence collection into day-2 Kubernetes operations across platform, NetOps, application, and security teams.
