search

javadmohebbi / goNfCollector

A set of tool to collect & analyze netflow & export them to many DBs & Apps like InfluxDB time-series DB
94 stars 20 forks source link

All sources showing as Docker NAT IP #28

Open JoshIPT opened 2 years ago

JoshIPT commented 2 years ago

The docker host IP of the swarm is 172.18.0.1 and all flows are showing as coming from this.

When I first composed the swarm they were showing up correctly, then after a reboot it began to do this and I cannot stop it. I removed it all and recomposed it with no change.

Alexandre-Santos commented 2 years ago

This seems related to how docker handles the connection tables. It happens also with other applications. You can read more here: https://github.com/moby/libnetwork/issues/1994

In my case I moved the collector to my topology and changed the container's network mode to host, but in the link there are some alternatives.