What it does
Kubeshark captures and indexes Kubernetes network traffic at the kernel level, making API calls and communication between workloads searchable through a browser dashboard. Operators can inspect live protocol traffic, map workload relationships, and export traffic snapshots as packet captures. It observes network behavior without relying on instrumentation libraries in each application. Kubeshark is an in-cluster analysis tool rather than a general-purpose metrics or log backend, so it needs a Kubernetes environment and another system for broader telemetry and incident workflows.
Run it beside the workloads you need to inspect
Kubeshark is installed in the Kubernetes cluster it observes. The official quick start calls for a running cluster, kubectl configured for it, and Helm, then adds Kubeshark's chart and forwards the dashboard service to a local browser. These instructions are examples from the documentation, not commands run here. The dashboard can show traffic with Kubernetes and API context, so a useful first pass is to target one service or namespace rather than dissecting every workload immediately.
Follow an API call, then keep a snapshot
Kubeshark can parse supported protocol traffic, show request and response information, and use Kubernetes identity to help narrow a search. Its workload map provides a view of which services communicate. For a later forensic review, the documented PCAP snapshot workflow exports a rolling window of cluster traffic for inspection with a packet-analysis tool.
Illustrative example, not a test: if one API begins returning server errors, an operator could narrow the captured traffic to the affected workload and inspect the corresponding request and response, then save a packet capture for a deeper review. The network evidence can help locate where communication changes, but it does not itself repair the application or network policy.
Keep resource use and stream scope in mind
Real-time dissection runs on worker nodes and consumes CPU and memory as traffic volume and protocol parsing increase. The performance guide recommends targeting only the pods or namespaces that matter; capture filters reduce the amount of traffic to process. Community is limited to three nodes or 60 pods and, like Pro, requires internet connectivity; the pricing page lists air-gapped operation under Enterprise.
Kubeshark also documents a WebSocket stream API. Its documentation states that the endpoint is authenticated but is not capability-gated and does not apply role namespace scoping, so any authenticated caller can receive the full stream. Review that access boundary before exposing the endpoint to integrations. The pricing page shows tier-based starting prices, but the exact quote for a particular deployment was not established here.
Strengths
- Indexes Kubernetes network traffic with workload and protocol context without requiring application code instrumentation.
- The dashboard supports live traffic inspection and workload relationship views, while snapshots provide packet captures for later analysis.
- A documented WebSocket API can provide captured data to external applications.
Watch out for
- The documented installation requires a Kubernetes cluster, kubectl access, and Helm.
- Real-time dissection consumes worker CPU and memory, with resource needs affected by traffic volume and the amount of traffic targeted.
- The free Community tier is limited to three nodes or 60 pods and requires internet connectivity; air-gapped support is listed for Enterprise.
- The documented WebSocket API is authenticated but not capability-gated or role-namespace-scoped, so any authenticated caller can receive the full stream.
Best for
- Investigating Kubernetes service-to-service or outbound traffic when application telemetry leaves communication paths unclear.
- Reviewing API traffic and exporting a packet capture for a later network investigation.
- Mapping workload relationships and traffic patterns across a Kubernetes cluster.
Sources
- Kubeshark Network Observability (Oct 26, 2026)
- Quick Start - Kubeshark (Oct 26, 2026)
- Pricing - Kubeshark (Oct 26, 2026)
- Websocket API Endpoints - Kubeshark (Oct 26, 2026)
- kubeshark/kubeshark (Oct 26, 2026)
- LICENSE (Kubeshark) (Oct 26, 2026)
- Deep Network Observability - Kubeshark (Oct 26, 2026)
- Take a cluster-wide PCAP snapshot - Kubeshark (Oct 26, 2026)
- CPU & Memory Consumption - Kubeshark (Oct 26, 2026)