<p>Turns out the answer is iptables, by adding a simple rule:</p>

<pre><code>sudo iptables -I FORWARD -s &lt;source ip&gt; -j TEE --gateway &lt;destination ip&gt;
</code></pre>

<p>e.g.:  </p>

<pre><code>sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4
</code></pre>

<p>I can clone the traffic, so if I do this:</p>

<pre><code>sudo iptables -I FORWARD -s &lt;Container1 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;
sudo iptables -I FORWARD -s &lt;Container2 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;
</code></pre>

<p>I will clone all traffic going between Containers1 and 2 to Wireshark container.</p>

<p>(Note that although this solution is a proof of concept, at the time of writing this answer)</p>

CC BY-SA 4.0
2019-05-30T12:49:45.137Z
2019-05-30T12:49:45.137Z
Meowxiik
<p>I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using <code>tshark</code> in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.</p>

<p>I've tried different <code>com.docker.network.bridge</code> options but none seem to work well. This is what my network looks like at the moment:</p>

<pre><code>[
    {
        "Name": "PKKJKO6WJEVH936CQ12H",
        "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1/16"
                }
            ]
        },
        "Containers": {
            "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                "Name": "insane_goldstine",
                "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                "Name": "berserk_ramanujan",
                "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                "Name": "clever_goldwasser",
                "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {}
    }
]
</code></pre>

<p>What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page <a href="https://en.wikipedia.org/wiki/Bridging_(networking)" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Bridging_(networking)</a> is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?</p>

<p>So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?</p>

<docker><networking>
How to perform low-level inspecting of a Docker network traffic?
Meowxiik
# How to perform low-level inspecting of a Docker network traffic?

(Asked by: username_0 on 2019-05-29)

I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using tshark in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.
I've tried different com.docker.network.bridge options but none seem to work well. This is what my network looks like at the moment:
[
    {
        "Name": "PKKJKO6WJEVH936CQ12H",
        "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1/16"
                }
            ]
        },
        "Containers": {
            "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                "Name": "insane_goldstine",
                "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                "Name": "berserk_ramanujan",
                "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                "Name": "clever_goldwasser",
                "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {}
    }
]

What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page https://en.wikipedia.org/wiki/Bridging_(networking) is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?
So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?

**Tags:** docker, networking


---

## 1 answers

### Answer by username_0 on 2019-05-30. Score: 1 | Accepted answer

Turns out the answer is iptables, by adding a simple rule:
sudo iptables -I FORWARD -s  -j TEE --gateway 

e.g.:  
sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4

I can clone the traffic, so if I do this:
sudo iptables -I FORWARD -s  -j TEE --gateway 
sudo iptables -I FORWARD -s  -j TEE --gateway 

I will clone all traffic going between Containers1 and 2 to Wireshark container.
(Note that although this solution is a proof of concept, at the time of writing this answer)


---

