Sniffing traffic coming to the Talos VM and bpf filters

[hellt]

Hi all,
I am trying to pcap traffic using a tcpdump filter:

talosctl --talosconfig rd/talosconfig -n rd-w1.dhn80.netdevops.me \
pcap --bpf-filter "{ 0x28, 0, 0, 0x0000000c },{ 0x15, 0, 7, 0x00000800 },{ 0x30, 0, 0, 0x00000017 },{ 0x15, 0, 11, 0x00000006 },{ 0x28, 0, 0, 0x00000014 },{ 0x45, 9, 0, 0x00001fff },{ 0xb1, 0, 0, 0x0000000e },{ 0x48, 0, 0, 0x00000010 },{ 0x15, 5, 6, 0x00000050 },{ 0x15, 0, 5, 0x000086dd },{ 0x30, 0, 0, 0x00000014 },{ 0x15, 0, 3, 0x00000006 },{ 0x28, 0, 0, 0x00000038 },{ 0x15, 0, 1, 0x00000050 },{ 0x6, 0, 0, 0x00040000 },{ 0x6, 0, 0, 0x00000000 },"

But i get this error:

unknown command "0x28," for "talosctl pcap"

The bpf filter is produced with

tcpdump -dd -y EN10MB 'tcp and dst port 80'

[hellt]

I apologize...
https://www.talos.dev/v1.7/reference/cli/#talosctl-pcap

[hellt]

I am using talos 1.7.4

[hellt]

sheesh, it was a user error

I am using talosctl container to run commands, and I was missing quotes around $@

docker run --rm -i ${TTY_FLAG} \
-v $(pwd):/workdir \
-w /workdir \
-u $(id -u):$(id -g) \
ghcr.io/siderolabs/talosctl:v1.7.4 "$@"