Docker Swarm Packet Capture

pcap-swarm.sh

#!/bin/bash

echo "[+] Getting docker swarm ingress network ID"

INGRESS=`sudo docker network ls | grep ingress | cut -b -10`

echo "[+] Ingress: $INGRESS"

echo "[+] Running netshoot container with tcpdump"
read -p "[?] Filename for packet capture: " OUTPUT_FILE

echo "[+] Output pcap is at: $PWD/$OUTPUT_FILE"

sudo docker run -it --rm \
	-v /var/run/docker/netns:/var/run/docker/netns \
	-v $PWD:/root/ \
	--privileged=true nicolaka/netshoot \
	nsenter --net=/var/run/docker/netns/1-$INGRESS \
	tcpdump -i any -w /root/$OUTPUT_FILE -v