Follow up for PacketCapture feature.

[hangyan]

Possible future improvements in the future:

• bi-direction capture
  This was marked as a future improvement during the design stage. We could add a bool field in the spec to turn this on.

• ipv6
  currently the ipFamily field in spec has a fixed value ipv4.

• tcp flags filter

• icmp echo/reply filter
  add new section in transportHeader struct to support icmp filters.

• antctl support
  download the pcap file directly from cli

• capture both on source/target
  users maybe want to check the diff.

Current issues:

1. captured file cannot be opened by tcpdump on mac, works on linux. ( Wireshark is fine on mac) (Fix PacketCapture pcapng file issue on macOS #6804)

reading from PCAP-NG file pc-test-tcp.pcapng. tcpdump: pcap_loop: invalid packet capture length 74, bigger than snaplen of 524288

this is the error message shown when reading packets from tcpdump on mac. It works fine with linux and WIreshark(mac).

2. [Flaky test] TestPacketCapture e2e test #6815

Related to:

1. Add packetcatpure feature #6756
2. [Proposal] A new PacketSampling CRD #5443

[hangyan]

cc @luolanzone

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days. You can add a label "lifecycle/frozen" to skip stale checking.

[luolanzone]

@hangyan I suppose we can close this since separate issues are created?