Kubeshark — API Traffic Viewer for Kubernetes

What it is

Kubeshark is an open-source real-time API traffic viewer for Kubernetes. Think of it as Wireshark for your cluster -- it captures pod-to-pod, pod-to-service, and external traffic at the node level using eBPF and raw sockets, then decodes application protocols in a browser-based UI.

It is built for platform engineers, SREs, and developers who need to debug microservice communication without modifying workloads or installing service mesh sidecars. Kubeshark decodes HTTP/1.1, HTTP/2, gRPC, Kafka, Redis, AMQP, MongoDB wire protocol, DNS, and raw TCP.

How it saves time or tokens

Traditional Kubernetes traffic debugging involves adding sidecar proxies, enabling verbose logging in each service, or deploying a full service mesh. Kubeshark eliminates all of that. A single kubeshark tap command deploys a DaemonSet that immediately starts capturing traffic across all pods in the cluster.

The built-in query language (KFL) lets you filter traffic in real time, so you can isolate the exact API call causing issues without sifting through logs. You can also export to PCAP files for offline analysis in Wireshark.

How to use

1. Install the CLI: sh <(curl -Ls https://kubeshark.co/install).
2. Run kubeshark tap against your current kube-context to capture traffic across all pods, or scope to a namespace with kubeshark tap -n my-ns.
3. Open the browser UI at http://localhost:8899 to view decoded traffic with filters.

Example

# Install the CLI
sh <(curl -Ls https://kubeshark.co/install)

# Tap all pods in the cluster
kubeshark tap

# Tap a specific namespace
kubeshark tap -n my-namespace

# Tap pods matching a pattern
kubeshark tap 'api-server.*'

# Open the UI at http://localhost:8899
# Use KFL to filter: http and request.path == '/api/v1/users'

Related on TokRepo

• DevOps tools -- infrastructure and operations tooling for cloud-native workflows
• Monitoring tools -- observability and monitoring solutions

Common pitfalls

• Kubeshark requires privileged DaemonSet pods with host network access; some managed Kubernetes providers restrict this by default.
• On high-traffic clusters, capturing all traffic can generate significant data volume -- use KFL filters or namespace scoping to reduce noise.
• eBPF-based capture requires a Linux kernel 4.16 or later; older kernels fall back to raw socket capture with reduced protocol support.