Snapshots

The Snapshots panel provides access to Traffic Snapshots directly from the dashboard. Create new snapshots, browse existing ones, and run Delayed Dissection on captured traffic.

Creating Snapshots

Create Snapshot Dialog

To create a new snapshot:

  1. Name — Enter a descriptive name (e.g., incident-2024-02-01, checkout-debug)
  2. Nodes — Select all nodes or specific worker nodes to include
  3. Time Window — Choose the time range (e.g., last 5 minutes, last 1 hour, last 12 hours)
  4. Click Create

The snapshot is extracted from Raw Capture buffers and moved to dedicated storage on the Hub.

ConstraintDescription
Maximum windowLimited by raw capture buffer size and traffic rate
AvailabilityData must not have been recycled from raw capture

Browsing Snapshots

Snapshots Tab

The Snapshots tab displays all available snapshots:

FieldDescription
NameSnapshot identifier
SizeTotal data size
Start Time / End TimeCaptured time window
StatusPending, In Progress, Completed, Dissected
Created AtWhen the snapshot was created
NodesWhich nodes are included

Snapshot Actions

ActionDescription
DissectRun Delayed Dissection on the snapshot
DownloadRetrieve the snapshot archive for offline storage
PCAPExport to PCAP file for Wireshark analysis
DeleteRemove the snapshot and free storage

Running Delayed Dissection

To analyze a snapshot with L7 protocol dissection:

  1. Select the snapshot from the list
  2. Click Dissect to start Delayed Dissection
  3. Monitor progress as the snapshot is processed
  4. Once complete, view dissected API calls in the L7 API Stream

Dissection runs on the Hub, not on worker nodes—keeping production compute unaffected.

Viewing Dissected Snapshots

After dissection completes, the snapshot’s API calls appear in the L7 API Stream. Use Display Filters to navigate the dissected traffic.

The stream shows the same rich data as real-time dissection:

  • Full request/response payloads
  • Headers and status codes
  • Kubernetes context (pod, service, namespace)
  • Timing information

PCAP Export

Export snapshots as PCAP files for analysis in Wireshark—an alternative to deploying tcpdump, copying files from nodes, and manually aggregating them.

Snapshots include all raw TCP/UDP packets, including decrypted TLS traffic, along with Kubernetes and OS context.

To export:

  1. Select a snapshot from the list
  2. Click PCAP
  3. Open the downloaded file in Wireshark

Opening the PCAP in Wireshark

Best Practices

Naming Conventions

Use descriptive names that include context:

  • incident-2024-02-01-checkout-failure
  • debug-payment-service-slow
  • audit-q1-2024

When to Create Snapshots

ScenarioRecommendation
Incident reportedImmediately capture relevant time window
Before maintenancePreserve baseline traffic for comparison
Compliance auditCreate periodic snapshots per retention policy
Performance investigationCapture before and during load tests

Storage Management

Monitor snapshot storage usage. Snapshots persist until explicitly deleted.

tap:
  snapshots:
    storageSize: 100Gi    # Allocate sufficient storage

See Helm Configuration for storage settings.

What’s Next