AKS Network Capture

Capture packet-level evidence on AKS when read-only diagnostics are inconclusive. Use this to prove where a packet is dropped — inside the pod, on the node, at an NSG, on a route, or at the Azure load balancer.

This is an escalation tool. For most networking symptoms (DNS, connectivity, ingress 502s), start with aks-troubleshooting; come here when you need a pcap or wire-level proof.

Safety model

Packet capture requires elevated node access, so these scripts are built to be safe by construction:

• No shell injection. User-supplied filters and targets are validated against strict allowlists, passed to tcpdump as a single trailing argument (never a shell string), and compile-checked in-pod with tcpdump -d. There is no eval. A negative regression test (evals/tests/aks-network-capture/injection.test.sh) proves malicious inputs are rejected.
• Scoped access, not privileged. Capture pods use only NET_ADMIN + NET_RAW with hostNetwork. They mount only /var/log/aks-network-captures from the node, never the node root, and never enable hostPID.
• Pinned images. Capture Jobs use Microsoft Retina's network-tool image from Microsoft Container Registry, pinned by digest; no Docker Hub, no :latest.

The live-cluster smoke test is manual and is not run in CI. Before relying on distributed capture in production, run evals/tests/aks-network-capture/smoke-live-cluster.sh against an AKS cluster you control; it uses an isolated namespace, generates bounded same-node DNS traffic, retrieves the exact run, decodes packet records, and verifies Kubernetes plus host-artifact cleanup.

Capture workflow