Capturing dropped traffic caused by a NetworkPolicy presents a unique challenge: because the packets are dropped by Open vSwitch (br-int) at the host kernel level before reaching the target container’s network interface, running tcpdump inside the destination pod will yield no results.

To capture these dropped packets using ksniff, you must use its privileged pod mode (-p). This spawns a privileged sniffer pod directly on the target node and attaches tcpdump to the veth pair or OVS port interface where the host handles the traffic.

Step 1: Identify the Target Pod & Node

Find the destination pod, its IP address, and the worker node hosting it:

Bash

oc get pod <pod-name> -n <namespace> -o wide

Note the Node Name (e.g., worker-1.example.com) and the Pod IP (e.g., 10.128.2.45).

Step 2: Run ksniff in Privileged Node Mode

Execute ksniff with the -p flag. This tells the plugin to create a privileged sniffer pod on worker-1.example.com that shares the host’s network namespace (hostNetwork: true), allowing it to see packets before OVN drops them.

Option A: Stream directly to Wireshark (GUI)

Bash

oc sniff <pod-name> \
  -n <namespace> \
  -p \
  -f "host 10.128.2.45"

Option B: Save to a .pcap file locally (Headless/CLI)

Bash

oc sniff <pod-name> \
  -n <namespace> \
  -p \
  -f "host 10.128.2.45 and tcp port 8080" \
  -o ./dropped_policy_traffic.pcap

Step 3: Analyze Dropped Packets in Wireshark

When inspecting the capture in Wireshark or via tshark:

1. Look for TCP SYN packets originating from the source pod directed at the target pod IP that receive no TCP SYN-ACK response.
2. Under OVN-Kubernetes, when a NetworkPolicy drops traffic, the OVS flow rule acts as a silent drop (action=drop). You will see repeated TCP retransmissions from the client side without any corresponding egress frames from the target container interface.

Alternative: Enable OVN NetworkPolicy Drop Logging (Native Method)

Rather than running packet captures, OpenShift allows you to log blocked NetworkPolicy traffic directly to journald or your logging stack by setting acl.logging on the network operator.

1. Enable drop logging on OVN-Kubernetes:
   Bashoc patch network.operator.openshift.io cluster --type=merge -p ' spec: defaultNetwork: ovnKubernetesConfig: policyAuditConfig: rateLimit: 20 maxEntries: 1000 destination: "journald" syslogFacility: "local0" '
2. Tail dropped network policy logs on the worker node:
   Bashoc debug node/worker-1.example.com -- chroot /host journalctl -u ovs-vswitchd -f | grep -i "drop" Output format:Plaintextovn-k8s-acl-logging|info|ACL verdict=drop policy="allow-frontend-only" srcIP=10.128.4.12 dstIP=10.128.2.45