>tcpdump</code> to determine encryption status. Also in Kubernetes 1.23 and later, as an alternative to installing Istio as privileged, you can use <code>kubectl debug</code> to run <code>tcpdump</code> in an <a href=https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-container>ephemeral container</a>. See <a href=/v1.20/docs/tasks/security/authentication/mtls-migration/>Istio mutual TLS migration</a> for instructions.</p></div><h5 id=non-istio-to-istio class=question>If mu