aks-network-capture — Claude Code skill: pcap from AKS nodes
Collects bounded packet captures from AKS nodes plus Azure network configuration, so you can show where packets actually drop.
/plugin marketplace add microsoft/skills
/plugin install aks-skills@skillsWhat aks-network-capture does
The skill runs tcpdump on AKS nodes or pods and saves the result as a pcap. Azure network configuration is gathered alongside it, which gives you wire-level evidence instead of a guess built on metrics.
Everything goes through bundled scripts: install the ConfigMap, create the capture, optionally generate test traffic, retrieve a specific run, then collect Azure network info. Each step has a Bash and a PowerShell version, and run-capture.sh runs inside the pinned Linux image from the ConfigMap. You need kubectl, and az for the Azure side.
Before any of that, the skill checks host capabilities: shell execution, access to the bound cluster, and an approved artifact destination. When a host blocks those, it won't invent a workaround — it hands you a collection plan instead. Capture intent is not mutation consent, so the debug-container fallback needs its own approval.
What it helps with
- take a pcap from a specific AKS node
- prove where along the path packets disappear
- collect Azure network config together with a capture
- generate test traffic to reproduce a failure
- retrieve the artifacts of one exact capture run
Example prompts for the agent
- Capture packets on the AKS node where traffic drops
- Take a pcap on this pod and gather the Azure network config
- Generate test traffic and show me where it stops
How to install aks-network-capture
1Plugin marketplace
/plugin marketplace add microsoft/skills/plugin install aks-skills@skillsThis installs the whole aks-skills plugin with all its skills
2Skills CLI (Vercel)
npx skills add microsoft/skills --skill aks-network-capture -a claude-code3Manually: put the files in place
~/.claude/skills/aks-network-capture/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/aks-network-capture/
Manually: put the files in place
.agents/skills/aks-network-capture/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/aks-network-capture/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install microsoft/skills aks-network-capture2Manually: put the files in place
.github/skills/aks-network-capture/SKILL.mdPlatform CLI
gemini skills install https://github.com/microsoft/skills --path .github/plugins/aks-skills/skills/aks-network-captureManually: put the files in place
.devin/skills/aks-network-capture/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about aks-network-capture
How do I install aks-network-capture in Claude Code?
Add the marketplace with /plugin marketplace add microsoft/skills, then install the plugin: /plugin install aks-skills@skills.
What does aks-network-capture do?
It collects bounded packet captures from AKS nodes and Azure network configuration. That gives packet-level evidence rather than a general connectivity conclusion.
What does the skill need to run?
kubectl for cluster access and az for Azure evidence. The host also has to permit Bash or PowerShell execution and access to the bundled scripts.
Source text
SKILL.md · MIT
--- name: aks-network-capture description: "Collects bounded packet captures from AKS nodes and Azure network configuration for wire-level evidence. WHEN: \"capture packets on an AKS node\", \"take a pcap\", \"run tcpdump on AKS\", \"prove where packets drop\". Use for explicit packet-capture intent after read-only diagnostics, not general AKS connectivity or ingress troubleshooting." license: MIT metadata: author: Microsoft version: "1.0.1" --- # AKS Network Capture ## Quick Reference | Use | Requires | Safety | | --- | --- | --- | | AKS pcap evidence | `kubectl`; `az` for Azure evidence | Bounded, pinned, least privilege | ## When to Use This Skill Use for explicit packet capture after read-only checks, not generic connectivity failures. ## MCP Tools Azure MCP's AKS area provides cluster and node-pool metadata, not Kubernetes command execution or packet capture. ## Host Capability Gate Before executing the workflow, confirm that the host permits the required Bash or PowerShell execution, `kubectl` access to the bound cluster, `az` for Azure evidence, access to the bundled scripts, and an approved artifact destination. A governed Azure CLI tool alone does not establish that shell, Kubernetes commands, or artifact operations are supported. If a required capability is unavailable or prohibited, state that capture execution is unavailable in this host. Analyze supplied, appropriately redacted evidence or give the operator a target-bound collection/capture plan; do not claim to have run it. Never route `kubectl` through Azure MCP, add an unapproved execution path, or bypass host policy. Host support does not replace the mutation and sensitive-data approvals below. Run bundled scripts from the skill root only after this gate is satisfied. ## Workflow/Steps 0. Check host capabilities, then complete [authorization and target binding](references/capture-authorization.md). Capture intent is not mutation consent. Stop for separate approval before any debug-container fallback. 1. Install [Bash](scripts/setup-capture-configmap.sh) / [PowerShell](scripts/setup-capture-configmap.ps1). 2. Capture nodes or pods with [Bash](scripts/create-capture.sh) / [PowerShell](scripts/create-capture.ps1). 3. Generate traffic if approved with [Bash](scripts/generate-test-traffic.sh) / [PowerShell](scripts/generate-test-traffic.ps1). 4. Retrieve the exact run with [Bash](scripts/retrieve-captures.sh) / [PowerShell](scripts/retrieve-captures.ps1). 5. Gather Azure evidence with [Bash](scripts/collect-azure-network-info.sh) / [PowerShell](scripts/collect-azure-network-info.ps1). The ConfigMap runs [run-capture.sh](scripts/run-capture.sh) inside its pinned Linux image. ## Error Handling | Error | Action | | --- | --- | | Invalid input | Correct it before retrying. | | Missing/stale ConfigMap | Run setup again. | | Capture/retrieval failure | Inspect Job logs; missing evidence is not success. |
© Microsoft · MIT · microsoft/skills
