17 lines
807 B
Plaintext
17 lines
807 B
Plaintext
|
version: "3.2"
|
||
|
|
|
||
|
|
services:
|
||
|
|
pcap-broker-remote-host:
|
||
|
|
image: pcap-broker:latest
|
||
|
|
restart: always
|
||
|
|
volumes:
|
||
|
|
# mount local user's SSH key into container
|
||
|
|
- ~/.ssh/id_ed25519:/root/.ssh/id_ed25519:ro
|
||
|
|
ports:
|
||
|
|
# make the PCAP-over-IP port also available on the host on port 4200
|
||
|
|
- 4200:4242
|
||
|
|
environment:
|
||
|
|
# Command to SSH into remote-host and execute tcpdump and filter out it's own SSH client traffic
|
||
|
|
PCAP_COMMAND: ssh root@remote-host -o StrictHostKeyChecking=no 'IFACE=$$(ip route show to default | grep -Po1 "dev \K\w+") && BPF=$$(echo $$SSH_CLIENT | awk "{printf \"not (host %s and port %s and %s)\", \$$1, \$$2, \$$3;}") && tcpdump -U --immediate-mode -ni $$IFACE $$BPF -s 65535 -w -'
|
||
|
|
LISTEN_ADDRESS: "0.0.0.0:4242"
|