Commands / kosa8 sandbox pcap
kosa8 sandbox pcap
Capture a running sandbox's network traffic to a pcapng file
Usage
kosa8 pcap SANDBOX [FILE]
Every frame the sandbox sends or receives is written, on the host, to a pcapng file that opens in Wireshark or tshark. The guest cannot see, stop or edit it — root in the guest included — because the capture is taken where the host's userspace network reads each frame.
Rotation: FILE is the first segment. At --pcap-max-mb it closes and FILE.2.pcapng, FILE.3.pcapng... follow; with --pcap-files N the oldest is deleted once N exist, so the capture never holds more than N × max on disk. --pcap-files 1 keeps one segment and stops when it is full, deleting nothing. Each closed segment's SHA-256 is written to the audit log (action sandbox.pcap.segment).
A capture holds everything the guest said in the clear — tokens, cookies, keys sent without TLS. The files are owner-only; treat them like the secrets they may contain.
Stop with kosa8 sandbox pcap SANDBOX --stop; stopping the sandbox also ends it.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--pcap-files | int | segments kept on disk; the oldest is deleted beyond this (1 = stop when full) | 8 |
--pcap-max-mb | int64 | size at which a capture segment closes and the next begins, in MiB | 64 |
--stop | bool | stop the running capture | — |
Example
kosa8 sandbox pcap dev ./dev.pcapng kosa8 sandbox pcap dev --stop tshark -r dev.pcapng -Y dns