Opinion: Why Wireshark 4.4 Is Overhyped for Cloud Debugging: Use Tcpdump 4.99 and Cilium 1.16 Instead

#!/bin/bash
# capture-pod-traffic.sh: Capture all traffic to/from a Kubernetes pod using tcpdump 4.99
# Requires: tcpdump 4.99+, kubectl 1.29+, Cilium 1.16+
set -euo pipefail

# Configuration
POD_NAME=""
NAMESPACE="default"
CAPTURE_DURATION=60  # seconds
OUTPUT_DIR="./captures"
TCPDUMP_BIN="/usr/bin/tcpdump"
CILIUM_BIN="/usr/bin/cilium"
MAX_RETRIES=3

# Usage function
usage() {
    echo "Usage: $0 --pod-name  [--namespace ] [--duration ] [--output-dir 

#!/bin/bash
# cilium-flow-capture.sh: Export Cilium 1.16 eBPF flows to PCAP via tcpdump 4.99
# Requires: Cilium 1.16+, hubble-cli 0.12+, tcpdump 4.99+
set -euo pipefail

# Configuration
CLUSTER_NAME="prod-cluster"
CAPTURE_INTERVAL=5  # seconds between flow samples
OUTPUT_DIR="./cilium-captures"
HUBBLE_BIN="/usr/bin/hubble"
TCPDUMP_BIN="/usr/bin/tcpdump"
FLOW_FILTER="source.namespace=production and destination.service.name=checkout-svc"
MAX_FILES=10  # Rotate captures after 10 files

# Usage
usage() {
    echo "Usage: $0 [--cluster ] [--interval ] [--filter ]"
    echo "Example: $0 --cluster staging --filter \"source.label.app=web\""
    exit 1
}

# Parse args
while [[ $# -gt 0 ]]; do
    case $1 in
        --cluster)
            CLUSTER_NAME="$2"
            shift 2
            ;;
        --interval)
            CAPTURE_INTERVAL="$2"
            shift 2
            ;;
        --filter)
            FLOW_FILTER="$2"
            shift 2
            ;;
        *)
            echo "Unknown arg: $1"
            usage
            ;;
    esac
done

# Check dependencies
if ! command -v "$HUBBLE_BIN" &> /dev/null; then
    echo "Error: hubble-cli not found. Install hubble 0.12+ from https://github.com/cilium/hubble"
    exit 1
fi

if ! command -v "$TCPDUMP_BIN" &> /dev/null; then
    echo "Error: tcpdump not found. Install tcpdump 4.99+ from https://github.com/the-tcpdump-group/tcpdump"
    exit 1
fi

# Check Cilium version
CILIUM_VERSION=$(cilium version | grep "Client" | awk '{print $3}' | tr -d 'v')
if [[ "$CILIUM_VERSION" < "1.16" ]]; then
    echo "Error: Cilium version $CILIUM_VERSION is too old. Requires 1.16+"
    exit 1
fi

# Create output dir
mkdir -p "$OUTPUT_DIR" || { echo "Error: Failed to create $OUTPUT_DIR"; exit 1; }

# Clean up old captures if exceeding max
cleanup_old_files() {
    local file_count=$(ls -1 "$OUTPUT_DIR"/*.pcap 2>/dev/null | wc -l)
    if [[ $file_count -ge $MAX_FILES ]]; then
        echo "Cleaning up old captures (keeping $MAX_FILES latest)..."
        ls -t "$OUTPUT_DIR"/*.pcap | tail -n +$((MAX_FILES +1)) | xargs rm -f
    fi
}

# Main capture loop
echo "Starting Cilium flow capture for cluster $CLUSTER_NAME with filter: $FLOW_FILTER"
echo "Capture interval: $CAPTURE_INTERVAL seconds. Output dir: $OUTPUT_DIR"

while true; do
    cleanup_old_files
    TIMESTAMP=$(date +%Y%m%d-%H%M%S)
    OUTPUT_FILE="$OUTPUT_DIR/cilium-flow-$TIMESTAMP.pcap"

    echo "[$(date)] Capturing flows for $CAPTURE_INTERVAL seconds..."

    # Get flows from hubble and convert to PCAP via tcpdump
    # Hubble flow format: we extract source/dest IPs and ports, then use tcpdump to generate PCAP
    $HUBBLE_BIN observe --cluster "$CLUSTER_NAME" --follow --timeout "$CAPTURE_INTERVAL" --filter "$FLOW_FILTER" -o json 2>/dev/null | \
    jq -r '.flow | "\(.source.ip):\(.source.port) > \(.destination.ip):\(.destination.port) \(.l4.protocol)"' | \
    while read -r flow; do
        SRC=$(echo "$flow" | awk '{print $1}')
        DST=$(echo "$flow" | awk '{print $3}')
        PROTO=$(echo "$flow" | awk '{print $4}')
        # Use tcpdump to generate a dummy PCAP entry for the flow (simplified for example)
        timeout 1 "$TCPDUMP_BIN" -i any -n -s 64 -w - "src $SRC and dst $DST and $PROTO" 2>/dev/null >> "$OUTPUT_FILE" || true
    done

    if [[ -f "$OUTPUT_FILE" ]]; then
        FILE_SIZE=$(du -h "$OUTPUT_FILE" | awk '{print $1}')
        echo "[$(date)] Capture saved to $OUTPUT_FILE (Size: $FILE_SIZE)"
    else
        echo "[$(date)] No flows captured in this interval"
    fi

    sleep "$CAPTURE_INTERVAL"
done

#!/usr/bin/env python3
# benchmark-capture-tools.py: Benchmark Wireshark 4.4 vs tcpdump 4.99 for cloud debugging
# Requires: psutil, subprocess, time, pandas
import subprocess
import time
import psutil
import json
import os
from typing import Dict, List

# Configuration
CAPTURE_DURATION = 30  # seconds per test
INTERFACE = "any"
CAPTURE_FILTER = "tcp port 80 or tcp port 443"
OUTPUT_DIR = "./benchmark-results"
TEST_RUNS = 3  # Number of runs per tool to average

class CaptureBenchmark:
    def __init__(self, tool_name: str, binary_path: str, version_arg: str):
        self.tool_name = tool_name
        self.binary_path = binary_path
        self.version_arg = version_arg
        self.results: List[Dict] = []

    def check_dependency(self) -> bool:
        """Check if tool is installed and get version"""
        try:
            result = subprocess.run(
                [self.binary_path, self.version_arg],
                capture_output=True, text=True, timeout=5
            )
            if result.returncode != 0:
                print(f"Error: {self.tool_name} not found at {self.binary_path}")
                return False
            version = result.stdout.split('\n')[0]
            print(f"Found {self.tool_name}: {version}")
            return True
        except Exception as e:
            print(f"Error checking {self.tool_name}: {e}")
            return False

    def get_memory_usage(self, pid: int) -> float:
        """Get memory usage of process in MB"""
        try:
            process = psutil.Process(pid)
            mem_info = process.memory_info()
            return mem_info.rss / 1024 / 1024  # Convert to MB
        except Exception:
            return 0.0

    def run_capture(self, output_file: str) -> Dict:
        """Run capture for CAPTURE_DURATION seconds, return metrics"""
        start_time = time.time()
        mem_samples = []

        # Start capture process
        if self.tool_name == "tcpdump":
            cmd = [
                self.binary_path, "-i", INTERFACE, "-n", "-s", "0",
                "-w", output_file, CAPTURE_FILTER
            ]
        elif self.tool_name == "wireshark":
            # Use tshark (Wireshark CLI) for headless capture
            cmd = [
                self.binary_path, "-i", INTERFACE, "-n", "-s", "0",
                "-w", output_file, CAPTURE_FILTER
            ]
        else:
            raise ValueError(f"Unknown tool: {self.tool_name}")

        try:
            proc = subprocess.Popen(
                cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE
            )
            pid = proc.pid

            # Sample memory every 1 second
            while time.time() - start_time < CAPTURE_DURATION:
                mem = self.get_memory_usage(pid)
                mem_samples.append(mem)
                time.sleep(1)

            # Stop capture
            proc.terminate()
            proc.wait(timeout=5)

            # Calculate metrics
            end_time = time.time()
            duration = end_time - start_time
            avg_mem = sum(mem_samples) / len(mem_samples) if mem_samples else 0.0
            max_mem = max(mem_samples) if mem_samples else 0.0
            file_size = os.path.getsize(output_file) / 1024 / 1024  # MB

            return {
                "tool": self.tool_name,
                "duration_sec": round(duration, 2),
                "avg_memory_mb": round(avg_mem, 2),
                "max_memory_mb": round(max_mem, 2),
                "output_size_mb": round(file_size, 2),
                "success": True
            }
        except Exception as e:
            print(f"Error running {self.tool_name} capture: {e}")
            if proc:
                proc.kill()
            return {
                "tool": self.tool_name,
                "success": False,
                "error": str(e)
            }

    def run_benchmark(self) -> List[Dict]:
        """Run benchmark TEST_RUNS times and average results"""
        os.makedirs(OUTPUT_DIR, exist_ok=True)
        for run in range(TEST_RUNS):
            print(f"\nRunning {self.tool_name} test {run +1}/{TEST_RUNS}...")
            output_file = os.path.join(
                OUTPUT_DIR, f"{self.tool_name}-run{run+1}.pcap"
            )
            result = self.run_capture(output_file)
            self.results.append(result)
        return self.results

def main():
    # Initialize tools
    tools = [
        CaptureBenchmark("tcpdump", "/usr/bin/tcpdump", "--version"),
        CaptureBenchmark("wireshark", "/usr/bin/tshark", "--version")
    ]

    # Check dependencies
    for tool in tools:
        if not tool.check_dependency():
            print(f"Skipping {tool.tool_name} due to missing dependency")
            tools.remove(tool)

    if len(tools) < 1:
        print("Error: No tools available to benchmark")
        return

    # Run benchmarks
    all_results = []
    for tool in tools:
        tool_results = tool.run_benchmark()
        all_results.extend(tool_results)

    # Save results to JSON
    results_file = os.path.join(OUTPUT_DIR, "benchmark-results.json")
    with open(results_file, 'w') as f:
        json.dump(all_results, f, indent=2)

    # Print summary
    print("\n=== Benchmark Summary ===")
    for tool in tools:
        successful_runs = [r for r in tool.results if r["success"]]
        if not successful_runs:
            print(f"\n{tool.tool_name}: All runs failed")
            continue
        avg_mem = sum(r["avg_memory_mb"] for r in successful_runs) / len(successful_runs)
        max_mem = max(r["max_memory_mb"] for r in successful_runs)
        avg_size = sum(r["output_size_mb"] for r in successful_runs) / len(successful_runs)
        print(f"\n{tool.tool_name} (v{subprocess.run([tool.binary_path, tool.version_arg], capture_output=True, text=True).stdout.split()[1]}):")
        print(f"  Average Memory Usage: {avg_mem:.2f} MB")
        print(f"  Max Memory Usage: {max_mem:.2f} MB")
        print(f"  Average Output Size: {avg_size:.2f} MB")

if __name__ == "__main__":
    main()

# Capture Cilium endpoint 1234 traffic with tcpdump 4.99 eBPF filter
sudo tcpdump -i any -n -s 0 -w cilium-endpoint-1234.pcap \
  "host 10.2.3.4 or port 4240"  # 10.2.3.4 is endpoint 1234's IP, 4240 is Hubble port

# Export Hubble flows for checkout service to PCAP via tcpdump
hubble observe --filter "destination.service.name=checkout-svc" -o json | \
jq -r '.flow | select(.l4.protocol == "tcp") | "src \(.source.ip) port \(.source.port) dst \(.destination.ip) port \(.destination.port)"' | \
xargs -I {} sudo tcpdump -i any -n -s 64 -w checkout-flows.pcap {}

# Remote capture on EKS node via kubectl exec
kubectl exec -it -n production pod/checkout-app-7f9d6c8b4-2xqkz -- \
  sudo tcpdump -i any -n -s 0 -c 1000 -w /tmp/checkout-capture.pcap
# Copy capture to local machine
kubectl cp -n production pod/checkout-app-7f9d6c8b4-2xqkz:/tmp/checkout-capture.pcap ./local-capture.pcap