Docker overlay networks

(Marco Gulino) #1

I'm trying to monitor packets (mainly http, mysql, redis, but it might be anything) using packetbeat on a Docker environment.
Using a single docker instance everything works flawlessly, but when I try the same thing using a docker cluster (swarm) with overlay networks packets are no more recognized.

Doing a little investigation, it seems that docker networks work over a vlan-like protocol, VxLan. I found an old blog post suggesting how to sniff vxlan packets in wireshark using a Lua script, and I was wondering if something similar is possible within packetbeat too:


(Steffen Siering) #2

VxLAN is building a virtual LAN by sending all network layers of virtual network via UDP in outer network.

This is currently not supported by packetbeat. Feel free to open a enhancement request.

(system) #3