Debug Kubernetes Network: troubleshooting commands
20 commands in 3 groups: DNS Resolution, Service Probes, Live Capture. Click or tap any command to copy it. Official documentation: kubernetes.io.
Open in the interactive cheat sheet search, stars and every other section
DNS Resolution
Verify cluster DNS is working from inside a pod, find the right name for a service, and inspect CoreDNS state.
kubectl exec -it <pod> -- cat /etc/resolv.conf
Inspect DNS config inside pod (search domains, nameservers)
kubectl exec -it <pod> -- dig +short <svc>.<ns>.svc.cluster.local
Compact DNS lookup using dig
kubectl exec -it <pod> -- nslookup <svc>.<ns>.svc.cluster.local
Resolve a service FQDN
kubectl exec -it <pod> -- nslookup kubernetes.default
Test in-cluster DNS resolution
kubectl get configmap coredns -n kube-system -o yaml
Inspect CoreDNS Corefile config
kubectl get pods -n kube-system -l k8s-app=kube-dns
List CoreDNS pods serving cluster DNS
kubectl logs -n kube-system -l k8s-app=kube-dns --tail=100
Recent CoreDNS logs (resolution errors, NXDOMAIN)
Service Probes
Probe services from inside a pod and verify the service has actual ready backends.
kubectl exec -it <pod> -- curl http://<service>:<port>
Test HTTP connectivity to service
kubectl exec -it <pod> -- curl -I http://<service>
HTTP HEAD to check status code and headers only
kubectl exec -it <pod> -- curl -v http://<service>:<port>
Verbose HTTP to see full request and response headers
kubectl exec -it <pod> -- nc -zv <host> <port>
Test TCP port reachability
kubectl exec -it <pod> -- wget -qO- http://<service>
HTTP request with wget from pod (alpine images)
kubectl get endpointslices -l kubernetes.io/service-name=<service>
Modern endpoint slices, replaces the Endpoints API
kubectl get service <name> -o jsonpath='{.spec.selector}'
Service selector (must match pod labels for endpoints to populate)
kubectl logs -n ingress-nginx -l app.kubernetes.io/component=controller --tail=100
Recent ingress-nginx controller logs (project retired March 2026)
Live Capture
Spawn a debug pod or attach an ephemeral container that shares the target pod network namespace, then capture or inspect traffic.
kubectl debug -it <pod> --image=nicolaka/netshoot --target=<container> --profile=general
Ephemeral container in the target net namespace, lets netshoot tcpdump/ss/curl see traffic from the pods perspective
kubectl exec -it <pod> -- netstat -tlnp
Listening TCP ports inside the container
kubectl exec -it <pod> -- ss -tlnp
Socket stats as a modern alternative to netstat
kubectl run netshoot --rm -it --image=nicolaka/netshoot -- bash
Standalone debug pod with full network toolset (curl, dig, nc, ss, tcpdump…)
kubectl run netshoot --rm -it --image=nicolaka/netshoot -- tcpdump -i any port <port>
Live packet capture from a debug pod