AWS eks: Clarify tcpdump packet capture applies only to EKS Auto Mode nodes
Summary
Rewrites the tcpdump capture guide to state that packet capture only works on EKS Auto Mode nodes (where the node monitoring agent image includes the tcpdump binary), notes the failure message seen on managed node groups/self-managed nodes, corrects the NodeDiagnostic node-name field, warns to confirm kubectl context, and documents the nested S3/capture output layout with updated decompression commands.
Security assessment
The change is a documentation accuracy fix about where the tcpdump capture feature is supported and where capture artifacts land in S3; it adds a kubectl context check but does not document a vulnerability, credential handling, or a security control, so no concrete security remediation is evidenced.
Evidence
+Packet capture requires the `tcpdump` binary to be present in the environment that the EKS node monitoring agent runs in. This is currently the case only on EKS Auto Mode nodes, where the agent runs as part of the node image.
Diff
diff --git a/eks/latest/userguide/auto-get-tcpdump.md b/eks/latest/userguide/auto-get-tcpdump.md index 12316d2..b706bb3 100644 --- a//eks/latest/userguide/auto-get-tcpdump.md +++ b//eks/latest/userguide/auto-get-tcpdump.md @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -# Capture network traffic on a managed node using kubectl and S3 +# Capture network traffic on an EKS Auto Mode node using kubectl and Amazon S3 @@ -15 +15,7 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -Learn how to capture network traffic on an Amazon EKS managed node that has the node monitoring agent. The agent runs tcpdump on the node, compresses capture files, and uploads them to your S3 bucket. +Learn how to capture network traffic on an Amazon EKS Auto Mode node. The EKS node monitoring agent runs `tcpdump` on the node, compresses capture files, and uploads them to your S3 bucket. + +###### Important + +Packet capture requires the `tcpdump` binary to be present in the environment that the EKS node monitoring agent runs in. This is currently the case only on EKS Auto Mode nodes, where the agent runs as part of the node image. + +When you install the agent as an EKS add-on or with Helm on other compute types, such as EKS managed node groups or self-managed nodes, the agent runs in a container that doesn’t include `tcpdump`. The capture fails immediately, and the capture status reports a `reason` of `Failure` with the message `failed to start tcpdump: exec: "tcpdump": executable file not found in $PATH`. @@ -21 +27 @@ Make sure you have the following: - * An existing Amazon EKS Auto Mode cluster with the node monitoring agent. For more information, see [Detect node health issues and enable automatic node repair](./node-health.html). + * An existing Amazon EKS Auto Mode cluster. EKS Auto Mode includes the EKS node monitoring agent. For more information, see [Detect node health issues and enable automatic node repair](./node-health.html). @@ -72 +78 @@ Common options: -The script requires Python 3 with `boto3` and `pyyaml` installed, and `kubectl` configured for your cluster. +The script requires Python 3 with `boto3` and `pyyaml` installed, and `kubectl` configured for your cluster. The script applies the resource to your current `kubectl` context, so if you work with more than one cluster, confirm your context first with `kubectl config current-context`. @@ -79 +85 @@ The script generates a `NodeDiagnostic` resource like the following. This exampl - name: <node-name> # Required: node instance ID + name: <node-name> # Required: node name as shown by kubectl get nodes @@ -126 +132,7 @@ Once the status shows `Success`, download the capture files from S3. -The files are gzip-compressed pcap format. Decompress and analyze with tcpdump or Wireshark: +The EKS node monitoring agent uploads each capture under a prefix that includes the `captureID`, so the downloaded files are nested rather than sitting directly in `./captures/`. The resulting layout is as follows. + + + captures/<node-name>/<captureID>/capture.pcap0000.gz + +The files are gzip-compressed pcap format. Decompress and analyze them with tcpdump or Wireshark. Because of the nesting, use a recursive pattern rather than a flat one. + @@ -127,0 +140,2 @@ The files are gzip-compressed pcap format. Decompress and analyze with tcpdump o + # Decompress every capture file that was downloaded + find captures -name '*.gz' -exec gunzip {} + @@ -129,2 +143,2 @@ The files are gzip-compressed pcap format. Decompress and analyze with tcpdump o - gunzip captures/*.gz - tcpdump -r captures/capture.pcap0000 -n + # Read one capture file + tcpdump -r captures/<node-name>/<captureID>/capture.pcap0000 -n