search

Graylog2 / graylog-docker

Official Graylog Docker image
https://hub.docker.com/r/graylog/graylog/
Apache License 2.0
369 stars 133 forks source link

source address is always fill with docker internal IP #238

Closed pradeepgunsgmail closed 1 year ago

pradeepgunsgmail commented 1 year ago

I’ve successfully deployed graylog cluster using docker. I’ve pointed few network devices to test netflow data and source address is always fill with docker internal IP instead of real network device IP. Please help me to resolve this.

image

bernd commented 1 year ago

@pradeepgunsgmail Graylog is taking the source address from the UDP packets it receives. Unfortunately, a known issue is that Docker is modifying the source address of UDP packets.

See the following issue for details: https://github.com/moby/moby/issues/16720#issuecomment-444862701

There is nothing we can do about it, sorry.