How to use netshoot to capture packets from a Docker container?

Run `docker run -it --net container: nicolaka/netshoot tcpdump -i eth0` to attach to the container's network namespace and start packet capture. This allows you to analyze traffic without installing tcpdump on the target container.

Netshoot vs busybox for network troubleshooting?

Netshoot includes a broader, more specialized toolset (e.g., iperf, nmap, grpcurl) tailored for containerized environments, while busybox offers basic utilities. Choose Netshoot for comprehensive diagnostics in Docker/Kubernetes, but busybox if you need minimal footprint for simple checks.

Can netshoot test gRPC services?

Yes, it includes grpcurl for interacting with gRPC servers. Use commands like `grpcurl -plaintext server:port Service/Method` from within the container to debug gRPC connections, as shown in the sample use-cases.

How to debug DNS issues in Kubernetes with netshoot?

Launch an ephemeral container with `kubectl debug -it --image=nicolaka/netshoot` and use tools like drill or nslookup to test DNS resolution from the pod's network namespace, checking for configuration or latency problems.

Is netshoot safe to run in production?

Use with caution: while it avoids installing tools on hosts, some operations require privileged access or host network mode, which can expose security risks. Limit usage to debugging sessions and follow least-privilege principles in your cluster.

What tools are included for network performance testing?

Netshoot has iperf, iperf3, and fortio for bandwidth and load testing. For example, use iperf in client-server mode between containers to measure throughput, as demonstrated in the iperf use-case.

Open-Awesome

netshoot

Apache-2.0Shell

A Docker and Kubernetes network troubleshooting container packed with networking tools for diagnosing connectivity, performance, and DNS issues.

GitHub

11.0k stars1.1k forks0 contributors

What is netshoot?

Netshoot is a Docker container specifically designed for troubleshooting network issues in Docker and Kubernetes environments. It provides a comprehensive suite of networking tools, allowing users to diagnose problems without installing packages directly on hosts or application containers. By leveraging network namespaces, it can seamlessly integrate into existing container or host network stacks for effective debugging.

Target Audience

DevOps engineers, SREs, and platform engineers who manage and troubleshoot containerized applications in Docker and Kubernetes environments.

Value Proposition

Developers choose Netshoot because it bundles a wide array of essential networking utilities into a single, portable container, eliminating the need to install tools on hosts or application containers. Its unique selling point is the ability to attach to any container, pod, or host network namespace, providing a 'swiss-army knife' for network diagnostics in modern infrastructures.

Overview

a Docker + Kubernetes network trouble-shooting swiss-army container

Use Cases

Best For

Troubleshooting network latency, routing, DNS resolution, firewall, or ARP issues in Docker containers.
Debugging Kubernetes pod networking using ephemeral containers or sidecar deployments without modifying the original pod.
Performing packet analysis and network performance testing (e.g., with tcpdump, iperf) in isolated container network namespaces.
Investigating host-level network problems by running tools in the host's network namespace without installing packages on the host.
Scanning and diagnosing open ports, network traffic, and bandwidth usage (e.g., with nmap, iftop, netstat) in containerized environments.
Testing SMTP, gRPC, or HTTP services and connections from within a container using tools like swaks, grpcurl, and fortio.

Not Ideal For

Environments not using Docker or Kubernetes, such as traditional VMs or bare-metal servers where direct host tool installation is required
Users needing graphical network analysis tools, as Netshoot is exclusively command-line based without GUI alternatives
Simple, one-off network checks that can be performed with basic OS commands without container overhead
Teams with strict security policies that prohibit running privileged containers or additional binaries in production

Pros & Cons

Pros

Comprehensive Tool Suite

Bundles over 50 networking utilities like tcpdump, iperf, nmap, and specialized tools (e.g., grpcurl, fortio), covering packet analysis, performance testing, and service debugging as listed in the README.

Seamless Namespace Integration

Leverages Docker and Kubernetes network namespaces to attach to containers, pods, or hosts via commands like --net container:<name> or kubectl debug, enabling troubleshooting without modifying target environments.

Kubernetes Native Support

Integrates with Kubernetes ephemeral containers, sidecar deployments, and has a dedicated kubectl plugin for easy pod and node debugging, as shown in the sample configurations.

Multi-Platform Ready

Tools are built for various architectures, ensuring compatibility across different deployment environments, mentioned in the key features for broad use.

Cons

Privileged Access Requirements

Tools like nsenter require running the container with --privileged flag, which poses security risks and may not be allowed in locked-down production clusters.

Large Container Footprint

Including numerous packages increases image size, making it less efficient for quick, lightweight operations compared to minimal tool-specific containers.

Assumes Advanced Knowledge

The README provides use-cases but assumes familiarity with CLI networking tools, offering limited guidance for beginners on tool selection or interpretation.

Frequently Asked Questions

Related Projects

MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

Stars11,838

Forks1,243

Last commit5 hours ago

Flannel

flannel is a network fabric for containers, designed for Kubernetes

Stars9,532

Forks2,886

Last commit22 hours ago

Pipework

Software-Defined Networking tools for LXC (LinuX Containers)

Stars4,253

Forks718

Last commit1 year ago

Freeflow

High performance container overlay networks on Linux. Enabling RDMA (on both InfiniBand and RoCE) and accelerating TCP to bare metal performance. Freeflow requires zero modification on application code/binary.

Stars639

Forks96

Last commit3 years ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub