--- title: Introducing Isopcap: Kubernetes-Native Packet Capture... description: Isopcap is a new Kubernetes-native packet capture product from Isovalent, part of the Isovalent Enterprise Platform. It lets platform teams define packet... canonical: https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations | daily.dev og:description: Isopcap is a new Kubernetes-native packet capture product from Isovalent, part of the Isovalent Enterprise Platform. It lets platform teams define packet... og:url: https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2 og:image: https://api.daily.dev/og/posts/oGhIYyut2.png og:image:alt: Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations **[Isovalent](https://daily.dev/sources/isovalent)** · 8 min read · 1 upvotes · 0 comments ## Summary Isopcap is a new Kubernetes-native packet capture product from Isovalent, part of the Isovalent Enterprise Platform. It lets platform teams define packet captures declaratively using a PacketCapture custom resource, targeting pods by label selectors, filtering with BPF, and bounding captures by duration or file size. The Isopcap agent runs as a DaemonSet, enters pod network namespaces, and writes standard PCAPng output without requiring SSH access to nodes, sidecar injection, or workload restarts. It supports primary and secondary interfaces (Multus, DRA, SR-IOV), pre-trigger rolling buffers for capturing traffic around intermittent events, RSPAN live streaming to Wireshark or tshark, file rotation, and per-node status via PacketCaptureNodeStatus. The goal is to bring packet-level evidence collection into day-2 Kubernetes operations across platform, NetOps, application, and security teams. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I capture network traffic from a specific pod in Kubernetes without SSHing into the node? Isopcap lets you define a PacketCapture custom resource targeting pods by label selector, interface, and optional BPF filter, and an agent DaemonSet running on each node enters the pod network namespace to capture traffic and write standard PCAPng files, avoiding SSH access, sidecars, or security setting changes. _Teams evaluating cloud-native alternatives to manual packet capture workflows can track tooling like this on daily.dev._ ### What is pre-trigger packet capture and why is it useful for debugging intermittent failures? Pre-trigger capture keeps a rolling local buffer of recent traffic (for example the last 30 seconds or 10 MiB) and only writes a merged PCAP file to persistent storage once a trigger fires, plus a configurable window of post-trigger traffic. This captures packets from before an issue occurred, not just after it is noticed, which is valuable for reproducing intermittent production failures. _Engineers chasing intermittent production incidents follow packet capture and observability tooling updates on daily.dev._ ## Similar posts on daily.dev - [Capturing Network Packets in Kubernetes](https://daily.dev/posts/capturing-network-packets-in-kubernetes-aoknueaaw) · Mercari Engineering · 1 upvotes · 0 comments - [Extending Infrastructure Fabric: The Journey to Cloud-Native Isovalent Networking](https://daily.dev/posts/extending-infrastructure-fabric-the-journey-to-cloud-native-isovalent-networking-dwiqat8eb) · Cisco · 0 upvotes · 0 comments - [Isovalent Networking for Virtualization: Enterprise-Grade Network Segmentation and Multi-Tenancy for VMs in Kubernetes](https://daily.dev/posts/isovalent-networking-for-virtualization-enterprise-grade-network-segmentation-and-multi-tenancy-for-qz1e8h38b) · Isovalent · 0 upvotes · 0 comments - [Inside the Packet: How Kubernetes Networking Actually Works at L3/L4](https://daily.dev/posts/inside-the-packet-how-kubernetes-networking-actually-works-at-l3-l4-mlktkkrux) · Container Journal · 1 upvotes · 0 comments - [Cisco is using eBPF to rethink firewalls, vulnerability mitigation](https://daily.dev/posts/cisco-is-using-ebpf-to-rethink-firewalls-vulnerability-mitigation-vwet8pf7l) · The New Stack · 1 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations","url":"https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2"},"datePublished":"2026-07-28T07:34:01.710Z","dateModified":"2026-09-13T21:32:05.990Z","description":"Isopcap is a new Kubernetes-native packet capture product from Isovalent, part of the Isovalent Enterprise Platform. It lets platform teams define packet...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3cf80508d2a8981f64603cd940c9dc43?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3cf80508d2a8981f64603cd940c9dc43?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Isovalent","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Isovalent","logo":"https://media.daily.dev/image/upload/s--aJv8XyPY--/f_auto/v1716188539/logos/isovalent","url":"https://daily.dev/sources/isovalent"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kubernetes,cilium","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Isovalent","item":"https://daily.dev/sources/isovalent"},{"@type":"ListItem","position":3,"name":"Introducing Isopcap: Kubernetes-Native Packet Capture for Cloud Native Operations"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-isopcap-kubernetes-native-packet-capture-for-cloud-native-operations-oghiyyut2#faq","mainEntity":[{"@type":"Question","name":"How do I capture network traffic from a specific pod in Kubernetes without SSHing into the node?","acceptedAnswer":{"@type":"Answer","text":"Isopcap lets you define a PacketCapture custom resource targeting pods by label selector, interface, and optional BPF filter, and an agent DaemonSet running on each node enters the pod network namespace to capture traffic and write standard PCAPng files, avoiding SSH access, sidecars, or security setting changes. Teams evaluating cloud-native alternatives to manual packet capture workflows can track tooling like this on daily.dev."}},{"@type":"Question","name":"What is pre-trigger packet capture and why is it useful for debugging intermittent failures?","acceptedAnswer":{"@type":"Answer","text":"Pre-trigger capture keeps a rolling local buffer of recent traffic (for example the last 30 seconds or 10 MiB) and only writes a merged PCAP file to persistent storage once a trigger fires, plus a configurable window of post-trigger traffic. This captures packets from before an issue occurred, not just after it is noticed, which is valuable for reproducing intermittent production failures. Engineers chasing intermittent production incidents follow packet capture and observability tooling updates on daily.dev."}}]} ```