diff --git a/whitebox_neutron_tempest_plugin/common/tcpdump_capture.py b/whitebox_neutron_tempest_plugin/common/tcpdump_capture.py
index 3bad21d..358cbe4 100644
--- a/whitebox_neutron_tempest_plugin/common/tcpdump_capture.py
+++ b/whitebox_neutron_tempest_plugin/common/tcpdump_capture.py
@@ -12,7 +12,6 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-import re
 import time
 
 import fixtures
@@ -32,28 +31,13 @@ class TcpdumpCapture(fixtures.Fixture):
     capture_files = None
     processes = None
 
-    def __init__(self, client, interfaces, filter_str=''):
+    def __init__(self, client, interfaces, filter_str='', extra_prefix=''):
         self.client = client
         self.interfaces = [ifc.strip() for ifc in interfaces.split(',')]
         self.filter_str = filter_str
         self.timeout = WB_CONF.capture_timeout
-        result = self.client.exec_command(
-            'which toolbox || echo missing')
-        if 'missing' in result:
-            cmd_prefix = "sudo timeout {}"
-            self.path_prefix = ''
-        else:
-            # (rsafrono) on coreos ocp nodes tcpdump is executed via
-            # toolbox. the toolbox can ask for update, therefore we need
-            # the 'yes no' to skip updating since it can take some time
-            cmd_prefix = "yes no | timeout {} toolbox"
-            # the toolbox runs in a container.
-            # host file system is mounted there to /host
-            self.path_prefix = '/host'
-            # when running tcpdump via the toolbox it is necessary
-            # to escape symbols like () in tcpdump filters
-            self.filter_str = re.escape(filter_str)
-        self.cmd_prefix = cmd_prefix.format(self.timeout)
+        self.cmd_prefix = "{} sudo timeout {}".format(
+            extra_prefix, self.timeout)
 
     def _setUp(self):
         self.start()
@@ -69,11 +53,10 @@ class TcpdumpCapture(fixtures.Fixture):
 
             for interface in self.interfaces:
                 process = self.client.open_session()
-                capture_file = self.client.exec_command(
-                    'mktemp -u').rstrip()
-                cmd = '{} tcpdump -s0 -Uni {} {} -w {}{}'.format(
-                    self.cmd_prefix, interface, self.filter_str,
-                    self.path_prefix, capture_file)
+                capture_file = self.client.exec_command('sudo mktemp').rstrip()
+                cmd = '{} tcpdump -s0 -Uni {} {} -w {}'.format(
+                    self.cmd_prefix, interface,
+                    self.filter_str, capture_file)
                 self.capture_files.append(capture_file)
                 LOG.debug('Executing command: {}'.format(cmd))
                 process.exec_command(cmd)
@@ -84,10 +67,6 @@ class TcpdumpCapture(fixtures.Fixture):
         for process in (self.processes or []):
             process.close()
         self.processes = None
-        if 'toolbox' in self.client.exec_command(
-                'which toolbox || true'):
-            self.client.exec_command(
-                "sudo podman stop toolbox-$(whoami) || true")
 
     def cleanup(self):
         self.stop()
@@ -140,7 +119,7 @@ class TcpdumpCapture(fixtures.Fixture):
                 merged_cap_file = cap_file_candidates[0]
             else:
                 merged_cap_file = self.client.exec_command(
-                    'mktemp -u').rstrip()
+                    self.cmd_prefix + ' mktemp').rstrip()
                 n_retries = 5
                 for i in range(n_retries):
                     try:
@@ -157,6 +136,6 @@ class TcpdumpCapture(fixtures.Fixture):
                         break
 
         ssh_channel = self.client.open_session()
-        ssh_channel.exec_command('cat ' + merged_cap_file)
+        ssh_channel.exec_command(self.cmd_prefix + ' cat ' + merged_cap_file)
         self.addCleanup(ssh_channel.close)
         return ssh_channel.makefile()
diff --git a/whitebox_neutron_tempest_plugin/tests/scenario/base.py b/whitebox_neutron_tempest_plugin/tests/scenario/base.py
index bb78376..846eee4 100644
--- a/whitebox_neutron_tempest_plugin/tests/scenario/base.py
+++ b/whitebox_neutron_tempest_plugin/tests/scenario/base.py
@@ -986,6 +986,16 @@ class TrafficFlowTest(BaseTempestWhiteboxTestCase):
                                     "for public network or public_network_id "
                                     "is not configured.")
         cls.discover_nodes()
+        if WB_CONF.openstack_type == 'podified':
+            cmd = ("{} get pods --field-selector=status.phase=Running "
+                   "-o custom-columns=NODE:.spec.nodeName,NAME:.metadata.name "
+                   "| grep ovn-controller-ovs".format(cls.OC))
+            output = cls.proxy_host_client.exec_command(
+                cmd).strip().split('\n')
+            for line in output:
+                for node in cls.nodes:
+                    if node['name'] == line.split()[0]:
+                        node['ovs_pod'] = line.split()[1]
 
     def _start_captures(self, interface, filters):
         def get_interface(client):
@@ -1007,14 +1017,19 @@ class TrafficFlowTest(BaseTempestWhiteboxTestCase):
                     return ','.join(interfaces)
 
         for node in self.nodes:
-            if interface:
-                node_interface = interface
+            if WB_CONF.openstack_type == 'podified' and node['is_controller']:
+                capture_client = self.proxy_host_client
+                command_prefix = "{} rsh {} ".format(self.OC, node['ovs_pod'])
+                capture_interface = interface if interface else 'datacentre'
             else:
-                node_interface = get_interface(node['client'])
+                capture_client = node['client']
+                command_prefix = ''
+                capture_interface = interface if interface else get_interface(
+                    node['client'])
             node['capture'] = capture.TcpdumpCapture(
-                node['client'], node_interface, filters)
+                capture_client, capture_interface, filters, command_prefix)
             self.useFixture(node['capture'])
-        time.sleep(5)
+        time.sleep(10)
 
     def _stop_captures(self):
         for node in self.nodes: