Cilium network policy kubectl-capture feature replaced our tcpdump sidecars for debugging

Cilium’s kubectl-capture is replacing tcpdump sidecars for Kubernetes network-policy debugging.

The eBPF-based approach captures traffic directly from pods without restarts or privileged sidecars.

It also adds policy-aware metadata, including verdicts and pod labels, for easier analysis in Wireshark.

The result is lower operational overhead, better security, and faster resolution of network-policy issues.