Docker Community Forums

Share and learn in the Docker community.

Docker capture packets


(Efratushhh) #1

I have a docker host with 3 containers running 3 different apps.

I’d like to install Suricata (IDS) / tcpdump on the host itself, to be able to: 1. Capture packets from a container and outside. 2. Capture packets between 2 containers.

Are 2 options possible? What is the procedure to get my goals?


(Nathan Le Claire) #2

Seems perfectly doable. Take a look at the docker0 bridge which containers use for communication by default.


(Efratushhh) #3

Great!!! Thanks…

BTW, if I want to run a different container for capturing those packets ( mirroring), for example, running tcpdump on another container - how can I do mirroring from docker0 to that container?

‫ב-14 ביולי 2016, בשעה 20:51, ‏‏Nathan Le Claire ‏docker@discoursemail.com כתב/ה:‬


(Nathan Le Claire) #4

You could potentially create them in the same docker network or just use --net host on the tcpdump container.


(Efratushhh) #5

Hey Nathan, thanks for your help!

Another question please,

Assume I have container A with IP 172.10.12.22 that gets some TCP/UDP traffic on port 3000.

Now assume I have another container, B, with IP 172.10.12.33 that listens on port 4000.

I’d like B to set as a tap for container A (able to monitor all of the traffic that A gets)

In other words, I’d like to mirror every traffic that A gets (whether it come from outside or from another container), into container B.

Is there a docker command for this?

Thanks,
Efrat!

‫ב-14 ביולי 2016, בשעה 23:22, ‏‏Nathan Le Claire ‏docker@discoursemail.com כתב/ה:‬


(Nathan Le Claire) #6

I’d just have a reverse proxy container and direct all inbound requests to that first before reverse proxying to the destination container. That way you can do whatever you like with the data streams.


(Efratushhh) #7

Thanks! Can you provide with some detailed instructions of how to do this? Maybe a Dockerfile sample? It might help me a lot.

‫ב-1 באוג׳ 2016, בשעה 21:00, ‏‏Nathan Le Claire ‏docker@discoursemail.com כתב/ה:‬


(Efratushhh) #8

Hi,

got another question for you, regarding Swarm,

I’ve got a Swarm manager and 3 workers.

I’d like to write a python script that subscribes to changes that are made
with Swarm (for example, getting an alert once a container is being created
and running, or getting an alert once a container is stopped).

Is it possible?

Thanks,
Efrat