How to perform low-level inspecting of a Docker network traffic?

Question

I'm currently in a scenario that requires Docker container C to be able to intercept communication between docker containers A and B, without their knowledge. I am basically attempting to do a standard man in the middle attack on my own containers. A and B are bridged right now. I'm using tshark in container C to inspect incoming traffic, but C is not recieving anything, except for initial broadcasting requests.

I've tried different com.docker.network.bridge options but none seem to work well. This is what my network looks like at the moment:

[
    {
        "Name": "PKKJKO6WJEVH936CQ12H",
        "Id": "5033f8958b845153f94beaa4b3bdbe17879ee331ad9441737687eac70b37fbc4",
        "Scope": "local",
        "Driver": "bridge",
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1/16"
                }
            ]
        },
        "Containers": {
            "41411a497edf7a632b042d71879d1c0b5941af0361325d2dbe4fefa9bbb30727": {
                "Name": "insane_goldstine",
                "EndpointID": "5c9ffaa6270e8a1823464fa1cdd9f64868083d32cfc7576a5843b1c76944353f",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "849135f83dca0d7261f03952b1648851dfb4c85a0cda0a7d1f5ab5b24e31a014": {
                "Name": "berserk_ramanujan",
                "EndpointID": "68a1ac542dea9fcfa1e35a209f571fc8c670f8d8ec33cf126c4dcde1bca1729d",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            },
            "af80dbfaf424fb4b8ce192a8d2e0e946d97ae1abb731bf3fc75918d31c084625": {
                "Name": "clever_goldwasser",
                "EndpointID": "0b2b3a4d24b63168abfbd0d32138ead9f1e053de60a1ac4487b2af87938e7cbd",
                "MacAddress": "02:42:ac:12:00:04",
                "IPv4Address": "172.18.0.4/16",
                "IPv6Address": ""
            }
        },
        "Options": {}
    }
]

What I believe is happenning is, that Docker bridge behaves like a standard networking bridge - it learns which MAC addresses are where and does not send traffic elsewhere. (At least if this page https://en.wikipedia.org/wiki/Bridging_(networking) is correct) Can Docker Bridge be configured to behave more like a networking hub? Possibly by keeping it's MAC memory empty? Or by continually erasing it?

So in conclusion, is there any way I configure docker, or container C, for C to listen to the traffic?

Answer 1

Turns out the answer is iptables, by adding a simple rule:

sudo iptables -I FORWARD -s <source ip> -j TEE --gateway <destination ip>

e.g.:

sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4

I can clone the traffic, so if I do this:

sudo iptables -I FORWARD -s <Container1 IP> -j TEE --gateway <Wireshark Container IP>
sudo iptables -I FORWARD -s <Container2 IP> -j TEE --gateway <Wireshark Container IP>

I will clone all traffic going between Containers1 and 2 to Wireshark container.

(Note that although this solution is a proof of concept, at the time of writing this answer)