1

I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using tshark in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.

I've tried different com.docker.network.bridge options but none seem to work well. This is what my network looks like at the moment:

[
    {
        "Name": "PKKJKO6WJEVH936CQ12H",
        "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1/16"
                }
            ]
        },
        "Containers": {
            "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                "Name": "insane_goldstine",
                "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                "Name": "berserk_ramanujan",
                "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                "Name": "clever_goldwasser",
                "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {}
    }
]

What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page https://en.wikipedia.org/wiki/Bridging_(networking) is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?

So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?

1

Turns out the answer is iptables, by adding a simple rule:

sudo iptables -I FORWARD -s <source ip> -j TEE --gateway <destination ip>

e.g.:

sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4

I can clone the traffic, so if I do this:

sudo iptables -I FORWARD -s <Container1 IP> -j TEE --gateway <Wireshark Container IP>
sudo iptables -I FORWARD -s <Container2 IP> -j TEE --gateway <Wireshark Container IP>

I will clone all traffic going between Containers1 and 2 to Wireshark container.

(Note that although this solution is a proof of concept, at the time of writing this answer)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.