search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.23k stars 3.84k forks source link

Capture HTTP packets between containers running on same host. #2630

Open collbrain opened 4 years ago

collbrain commented 4 years ago

I have two docker containers d-1 & d-2, running on same hosts connected via docker0 interface. I am running http_filter(https://github.com/iovisor/bcc/tree/master/examples/networking/http_filter) to capture packets between d-1 & d-2. Note that this ebpf capture runs on interface docker0

I don't see any packets getting captured but when i run tcpdump -i docker0 $ip-of-docker0, see packets are getting capture.

1) Why do i see traffic when tcpdump is enabled ? 2) How do i get around the problem ?

collbrain commented 4 years ago

Folks, any help here ?

yarochewsky commented 4 years ago

How are you running the ebpf container? For namespace sharing, you need the --privilege flag