Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/shaded-enmity/docker-network-capture

Capture network traffic of a running container
https://github.com/shaded-enmity/docker-network-capture

capture debugging docker network traffic

Last synced: 11 days ago
JSON representation

Capture network traffic of a running container

Host: GitHub
URL: https://github.com/shaded-enmity/docker-network-capture
Owner: shaded-enmity
License: gpl-2.0
Created: 2016-10-12T15:45:53.000Z (over 8 years ago)
Default Branch: master
Last Pushed: 2016-11-29T15:33:55.000Z (about 8 years ago)
Last Synced: 2025-01-10T10:14:05.067Z (24 days ago)
Topics: capture, debugging, docker, network, traffic
Language: Python
Size: 44.9 KB
Stars: 13
Watchers: 0
Forks: 8
Open Issues: 1
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

README

# docker-network-capture

A small utility written in Python3 that can help you debug network problems of Docker containers.

## Prerequisites

Make sure you have `tcpdump` package installed, the execution requires root privileges

## Installation

Via PIP:
```
$ pip3 install docker-network-capture
```

## Usage

```
usage: docker-network-capture [-h] [--verbose] [-b BRIDGE] [-c CAPTURE] [-j]
[-d DOCKER]
container

positional arguments:
container

optional arguments:
-h, --help show this help message and exit
--verbose
-b BRIDGE, --bridge BRIDGE
Docker bridge to use
-c CAPTURE, --capture CAPTURE
Direction of traffic to capture [egress,ingress]
-j, --json buffer data and output JSON at the end
-d DOCKER, --docker DOCKER
```

## Architecture & Security

![DNC ARCHITECTURE](https://github.com/shaded-enmity/docker-network-capture/blob/master/media/dnc_architecture.jpg "DNC ARCHITECTURE")

The main process starts off as `root` and creates two pipeline producers, one for the ethernet interface of the container and one for the namespaced loopback interface. Each pipeline launches it's own `tcpdump` capture process, after that is done, the main process deprivileges itself by changing it's UID/GID/Groups settings to nobody. After the `tcpdump` process is ready, a new process is forked, which is immediately deprivileged in the same way as the main process, and this process then handles the the parsing of raw byte stream into packets via PCAP and feeding them back to the main process via the `Queue`.

## Example

In the following example we see the output of `docker-network-capture` for a container
in which `curl google.com` was executed:

```
$ sudo docker-network-capture --capture=egress,ingress 92707a5e8369
OUT: 10.38.5.26:53
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| 2F 59 01 00 00 01 00 00 00 00 00 00 06 67 6F 6F |/Y...........goo|
| 67 6C 65 03 63 6F 6D 00 00 01 00 01 |gle.com..... |
+-------------------------------------------------+----------------+
OUT: 10.38.5.26:53
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| CE B8 01 00 00 01 00 00 00 00 00 00 06 67 6F 6F |.............goo|
| 67 6C 65 03 63 6F 6D 00 00 1C 00 01 |gle.com..... |
+-------------------------------------------------+----------------+
IN: 10.38.5.26:53
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| 2F 59 81 80 00 01 00 01 00 00 00 00 06 67 6F 6F |/Y...........goo|
| 67 6C 65 03 63 6F 6D 00 00 01 00 01 C0 0C 00 01 |gle.com.........|
| 00 01 00 00 00 99 00 04 D8 3A D0 2E |.........:.. |
+-------------------------------------------------+----------------+
IN: 10.38.5.26:53
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| CE B8 81 80 00 01 00 01 00 00 00 00 06 67 6F 6F |.............goo|
| 67 6C 65 03 63 6F 6D 00 00 1C 00 01 C0 0C 00 1C |gle.com.........|
| 00 01 00 00 00 99 00 10 2A 00 14 50 40 01 08 15 |........*..P@...|
| 00 00 00 00 00 00 20 0E |...... . |
+-------------------------------------------------+----------------+
OUT: 216.58.208.46:80
IN: 216.58.208.46:80
OUT: 216.58.208.46:80
OUT: 216.58.208.46:80
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 31 0D 0A |GET / HTTP/1.1..|
| 48 6F 73 74 3A 20 67 6F 6F 67 6C 65 2E 63 6F 6D |Host: google.com|
| 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 63 75 |..User-Agent: cu|
| 72 6C 2F 37 2E 34 37 2E 31 0D 0A 41 63 63 65 70 |rl/7.47.1..Accep|
| 74 3A 20 2A 2F 2A 0D 0A 0D 0A |t: */*.... |
+-------------------------------------------------+----------------+
IN: 216.58.208.46:80
IN: 216.58.208.46:80
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
+-------------------------------------------------+----------------+
| 48 54 54 50 2F 31 2E 31 20 33 30 32 20 46 6F 75 |HTTP/1.1 302 Fou|
| 6E 64 0D 0A 43 61 63 68 65 2D 43 6F 6E 74 72 6F |nd..Cache-Contro|
| 6C 3A 20 70 72 69 76 61 74 65 0D 0A 43 6F 6E 74 |l: private..Cont|
| 65 6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 68 |ent-Type: text/h|
| 74 6D 6C 3B 20 63 68 61 72 73 65 74 3D 55 54 46 |tml; charset=UTF|
| 2D 38 0D 0A 4C 6F 63 61 74 69 6F 6E 3A 20 68 74 |-8..Location: ht|
| 74 70 3A 2F 2F 77 77 77 2E 67 6F 6F 67 6C 65 2E |tp://www.google.|
| 63 7A 2F 3F 67 66 65 5F 72 64 3D 63 72 26 65 69 |cz/?gfe_rd=cr&ei|
| 3D 50 72 63 45 57 49 4F 64 49 34 4C 62 38 41 66 |=PrcEWIOdI4Lb8Af|
| 52 34 62 76 67 44 51 0D 0A 43 6F 6E 74 65 6E 74 |R4bvgDQ..Content|
| 2D 4C 65 6E 67 74 68 3A 20 32 35 38 0D 0A 44 61 |-Length: 258..Da|
| 74 65 3A 20 4D 6F 6E 2C 20 31 37 20 4F 63 74 20 |te: Mon, 17 Oct |
| 32 30 31 36 20 31 31 3A 33 34 3A 32 32 20 47 4D |2016 11:34:22 GM|
| 54 0D 0A 0D 0A 3C 48 54 4D 4C 3E 3C 48 45 41 44 |T.....302 M|
| 6F 76 65 64 3C 2F 54 49 54 4C 45 3E 3C 2F 48 45 |oved.

30|
| 32 20 4D 6F 76 65 64 3C 2F 48 31 3E 0A 54 68 65 |2 Moved

And here's the same request but with a JSON formatted output:

```
[
{
"payload": "5be60100000100000000000006676f6f676c6503636f6d0000010001",
"src_port": "36838",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "10.38.5.26",
"dst_port": "53"
},
{
"payload": "1dd30100000100000000000006676f6f676c6503636f6d00001c0001",
"src_port": "36838",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "10.38.5.26",
"dst_port": "53"
},
{
"payload": "5be68180000100010000000006676f6f676c6503636f6d0000010001c00c00010001000000890004d83ad02e",
"src_port": "53",
"interface": "docker0",
"src": "10.38.5.26",
"dst": "172.17.0.2",
"dst_port": "36838"
},
{
"payload": "1dd38180000100010000000006676f6f676c6503636f6d00001c0001c00c001c00010000008900102a00145040010815000000000000200e",
"src_port": "53",
"interface": "docker0",
"src": "10.38.5.26",
"dst": "172.17.0.2",
"dst_port": "36838"
},
{
"payload": "",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
},
{
"payload": "",
"src_port": "80",
"interface": "docker0",
"src": "216.58.208.46",
"dst": "172.17.0.2",
"dst_port": "46094"
},
{
"payload": "",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
},
{
"payload": "474554202f20485454502f312e310d0a486f73743a20676f6f676c652e636f6d0d0a557365722d4167656e743a206375726c2f372e34372e310d0a4163636570743a202a2f2a0d0a0d0a",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
},
{
"payload": "",
"src_port": "80",
"interface": "docker0",
"src": "216.58.208.46",
"dst": "172.17.0.2",
"dst_port": "46094"
},
{
"payload": "485454502f312e312033303220466f756e640d0a43616368652d436f6e74726f6c3a20707269766174650d0a436f6e74656e742d547970653a20746578742f68746d6c3b20636861727365743d5554462d380d0a4c6f636174696f6e3a20687474703a2f2f7777772e676f6f676c652e637a2f3f6766655f72643d63722665693d54726345574e7a5247596a6238416648376f4b6f42510d0a436f6e74656e742d4c656e6774683a203235380d0a446174653a204d6f6e2c203137204f637420323031362031313a33343a333820474d540d0a0d0a3c48544d4c3e3c484541443e3c6d65746120687474702d65717569763d22636f6e74656e742d747970652220636f6e74656e743d22746578742f68746d6c3b636861727365743d7574662d38223e0a3c5449544c453e333032204d6f7665643c2f5449544c453e3c2f484541443e3c424f44593e0a3c48313e333032204d6f7665643c2f48313e0a54686520646f63756d656e7420686173206d6f7665640a3c4120485245463d22687474703a2f2f7777772e676f6f676c652e637a2f3f6766655f72643d637226616d703b65693d54726345574e7a5247596a6238416648376f4b6f4251223e686572653c2f413e2e0d0a3c2f424f44593e3c2f48544d4c3e0d0a",
"src_port": "80",
"interface": "docker0",
"src": "216.58.208.46",
"dst": "172.17.0.2",
"dst_port": "46094"
},
{
"payload": "",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
},
{
"payload": "",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
},
{
"payload": "",
"src_port": "80",
"interface": "docker0",
"src": "216.58.208.46",
"dst": "172.17.0.2",
"dst_port": "46094"
},
{
"payload": "",
"src_port": "46094",
"interface": "docker0",
"src": "172.17.0.2",
"dst": "216.58.208.46",
"dst_port": "80"
}
]

```

## License

GNU/GPL 2.0

Ecosyste.ms: Awesome

https://github.com/shaded-enmity/docker-network-capture

Awesome Lists containing this project

README

30| | 32 20 4D 6F 76 65 64 3C 2F 48 31 3E 0A 54 68 65 |2 Moved

30|
| 32 20 4D 6F 76 65 64 3C 2F 48 31 3E 0A 54 68 65 |2 Moved