How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn.

Normally running tshark -f "port 53" clutters the output because it includes DNS queries from the main interface that the network namespace ends up using.

This is my network namespace setup (for what it's worth, this is from the openvpn netns-up script here: http://www.naju.se/articles/openvpn-netns.html)

$ ip netns add vpn
$ ip netns exec vpn ip link set dev lo up
$ ip link set dev tun0 up netns vpn mtu 1500
$ ip netns exec vpn ip addr add dev tun0 ""

$ ip netns exec vpn ip addr add dev tun0 "$ifconfig_ipv6_local"/112

$ ip netns exec vpn ip route add default via

$ ip netns exec vpn ip route add default via "$ifconfig_ipv6_remote"

1 Answer 1


You can just continue with the same unshortened syntax you were using for executing a command inside a network namespace created with ip netns add:

ip netns exec vpn <command-for-capture>


ip netns exec vpn tshark -i tun0 -n -f 'port 53'

Note tshark's option -n to avoid triggering DNS resolution, especially important when capturing DNS traffic, without which cascading DNS resolutions and captures caused by tshark itself would pollute original traffic.

As a side note, the ip command itself has a shortcut allowing to replace ip netns exec FOO ip BAR ... with ip -n FOO BAR ..., but of course this can't be used for any other command. A lot of OP's setup can be shortened into ip -n vpn ... instead of ip netns exec vpn ip ....

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .