How to collect the packet capture from container level and vm level

Products

• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

For app-instance packet capture, there are two options to collect tcpdump:

• Container-level capture
• VM-level (bosh pcap) capture with filters

Resolution

• Container-level capture (when appropriate): KB has been published for collecting a packet capture by SSH’ing into an app container and using tcpdump, then moving the pcap off-box.
  • KB: https://knowledge.broadcom.com/external/article?articleNumber=298167
• VM-level (bosh pcap) capture with filters: not perfectly scoped to the app instance, but often you can filter to the app’s backend/service IPs and ports.
  • Document: https://bosh.io/docs/cli-v2/#pcap-mgmt

# capture network traffic on one instance group
bosh -e vbox -d cf pcap router -o capture.pcap

# capture network traffic on a single instance
bosh -e vbox -d cf pcap router/<GUID> -o capture.pcap

# capture network traffic with filter for a specific source host
bosh -e vbox -d cf pcap router -f "src host 192.168.#.##" -o capture.pcap

# capture network traffic with snap length 64 to save the first 64 bytes of each packet and filter for specific hosts
bosh -e vbox -d cf pcap router -f "host 192.168.#.#1 or host 192.168.#.#2" -s 64 -o capture.pcap