Answers: <p>Turns out the answer is iptables, by adding a simple rule:</p>
  
  <pre><code>sudo iptables -I FORWARD -s &lt;source ip&gt; -j TEE --gateway &lt;destination ip&gt;
  </code></pre>
  
  <p>e.g.:  </p>
  
  <pre><code>sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4
  </code></pre>
  
  <p>I can clone the traffic, so if I do this:</p>
  
  <pre><code>sudo iptables -I FORWARD -s &lt;Container1 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;
  sudo iptables -I FORWARD -s &lt;Container2 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;
  </code></pre>
  
  <p>I will clone all traffic going between Containers1 and 2 to Wireshark container.</p>
  
  <p>(Note that although this solution is a proof of concept, at the time of writing this answer)</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-05-30T12:49:45.137Z
Answers: 2019-05-30T12:49:45.137Z
Answers: Meowxiik
Body: <p>I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using <code>tshark</code> in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.</p>
  
  <p>I've tried different <code>com.docker.network.bridge</code> options but none seem to work well. This is what my network looks like at the moment:</p>
  
  <pre><code>[
      {
          "Name": "PKKJKO6WJEVH936CQ12H",
          "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
          "Scope": "local",
          "Driver": "bridge",
          "IPAM": {
              "Driver": "default",
              "Options": {},
              "Config": [
                  {
                      "Subnet": "172.18.0.0/16",
                      "Gateway": "172.18.0.1/16"
                  }
              ]
          },
          "Containers": {
              "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                  "Name": "insane_goldstine",
                  "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                  "MacAddress": "02:42:ac:12:00:03",
                  "IPv4Address": "172.18.0.3/16",
                  "IPv6Address": ""
              },
              "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                  "Name": "berserk_ramanujan",
                  "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                  "MacAddress": "02:42:ac:12:00:02",
                  "IPv4Address": "172.18.0.2/16",
                  "IPv6Address": ""
              },
              "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                  "Name": "clever_goldwasser",
                  "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                  "MacAddress": "02:42:ac:12:00:04",
                  "IPv4Address": "172.18.0.4/16",
                  "IPv6Address": ""
              }
          },
          "Options": {}
      }
  ]
  </code></pre>
  
  <p>What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page <a href="https://en.wikipedia.org/wiki/Bridging_(networking)" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Bridging_(networking)</a> is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?</p>
  
  <p>So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?</p>
  
Tags: <docker><networking>
Title: How to perform low-level inspecting of a Docker network traffic?
UserDisplayName: Meowxiik
ThreadText: # How to perform low-level inspecting of a Docker network traffic?
  
  (Asked by: username_0 on 2019-05-29)
  
  I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using `tshark` in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.
  
  I've tried different `com.docker.network.bridge` options but none seem to work well. This is what my network looks like at the moment:
  
  ```
  [
      {
          "Name": "PKKJKO6WJEVH936CQ12H",
          "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
          "Scope": "local",
          "Driver": "bridge",
          "IPAM": {
              "Driver": "default",
              "Options": {},
              "Config": [
                  {
                      "Subnet": "172.18.0.0/16",
                      "Gateway": "172.18.0.1/16"
                  }
              ]
          },
          "Containers": {
              "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                  "Name": "insane_goldstine",
                  "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                  "MacAddress": "02:42:ac:12:00:03",
                  "IPv4Address": "172.18.0.3/16",
                  "IPv6Address": ""
              },
              "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                  "Name": "berserk_ramanujan",
                  "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                  "MacAddress": "02:42:ac:12:00:02",
                  "IPv4Address": "172.18.0.2/16",
                  "IPv6Address": ""
              },
              "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                  "Name": "clever_goldwasser",
                  "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                  "MacAddress": "02:42:ac:12:00:04",
                  "IPv4Address": "172.18.0.4/16",
                  "IPv6Address": ""
              }
          },
          "Options": {}
      }
  ]
  
  ```
  
  What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page <https://en.wikipedia.org/wiki/Bridging_(networking)> is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?
  
  So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?
  
  **Tags:** docker, networking
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-05-30. Score: 1 | Accepted answer
  
  Turns out the answer is iptables, by adding a simple rule:
  
  ```
  sudo iptables -I FORWARD -s <source ip> -j TEE --gateway <destination ip>
  
  ```
  
  e.g.:
  
  ```
  sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4
  
  ```
  
  I can clone the traffic, so if I do this:
  
  ```
  sudo iptables -I FORWARD -s <Container1 IP> -j TEE --gateway <Wireshark Container IP>
  sudo iptables -I FORWARD -s <Container2 IP> -j TEE --gateway <Wireshark Container IP>
  
  ```
  
  I will clone all traffic going between Containers1 and 2 to Wireshark container.
  
  (Note that although this solution is a proof of concept, at the time of writing this answer)
  
  
  ---
  
  