spe — Senior PCAP Engineer

Automated multi-pod packet capture for Kubernetes.

Why "Senior PCAP Engineer"?

If you've ever looped ksniff across pods with a bash one-liner while Slack was on fire, this tool is for you.

The Kubernetes ecosystem has certifications for everything, but nobody certifies the person who actually reads pcap files at 3am when packets are getting dropped and nobody knows why. That person is the Senior PCAP Engineer. This CLI exists to make that job slightly less painful.

It captures traffic from multiple pods in parallel, merges the pcaps into a single timeline, and optionally generates JSON flow logs you can throw into your SIEM. No DaemonSet, no operator, no sidecar. Just a binary that talks to the K8s API and runs tcpdump for you.

Install

Binary releases

Download from GitHub Releases for Linux, macOS, and Windows.

# Linux amd64
curl -LO https://github.com/azemoning/senior-pcap-engineer/releases/latest/download/spe-linux-amd64
chmod +x spe-linux-amd64
sudo mv spe-linux-amd64 /usr/local/bin/spe

Go install

go install github.com/azemoning/senior-pcap-engineer@latest

Container image

docker pull ghcr.io/azemoning/senior-pcap-engineer:latest

# Run inside a cluster
kubectl run spe --rm -it \
  --image=ghcr.io/azemoning/senior-pcap-engineer:latest \
  --restart=Never \
  --overrides='{
    "spec": {
      "serviceAccountName": "spe",
      "containers": [{
        "name": "spe",
        "image": "ghcr.io/azemoning/senior-pcap-engineer:latest",
        "command": ["spe", "start", "--namespace", "prod", "--label", "app=api", "--duration", "2m"]
      }]
    }
  }'

Build from source

git clone https://github.com/azemoning/senior-pcap-engineer.git
cd senior-pcap-engineer
make build

Usage

# Capture from pods matching a label
spe start --namespace prod --label "app=api" --duration 2m

# Capture from pods matching a glob pattern
spe start --namespace prod --pod "web-*" --filter "port 8080"

# Capture from all pods behind a service
spe start --namespace prod --service api-gateway --duration 5m

# Merge captures into single pcap
spe start --namespace prod --label "app=payment" --mode merge --duration 10m

# Generate JSON flow logs
spe start --namespace prod --label "app=api" --format both --duration 2m

# Upload to S3
spe start --namespace prod --label "app=api" --duration 2m --upload s3://forensics/case-42

# List sessions
spe list

# Export a session
spe export spe-20260711-a3f2 --upload s3://forensics/

How it works

1. Resolves target pods by label, name pattern, or service
2. Creates ephemeral debug containers (or uses direct exec on older K8s)
3. Runs tcpdump in parallel across all targets
4. Optionally merges pcap files by timestamp
5. Optionally generates JSON flow logs
6. Optionally uploads to S3

Requirements

• Go 1.24+
• kubectl configured with cluster access
• Kubernetes 1.23+ (for ephemeral containers)
• tcpdump in target pods (fallback for K8s < 1.23)