Update README.md and docker-compose.yml example (#9)
This commit is contained in:
@@ -1,16 +1,25 @@
|
||||
version: "3.2"
|
||||
|
||||
services:
|
||||
|
||||
pcap-broker-remote-host:
|
||||
image: pcap-broker:latest
|
||||
container_name: pcap-broker-remote-host
|
||||
restart: always
|
||||
volumes:
|
||||
# mount local user's SSH key into container
|
||||
# Mount the private key into container that wil be used for SSH
|
||||
# Ensure that on the `remote-host` the public key is in the /root/.ssh/authorized_keys file.
|
||||
- ~/.ssh/id_ed25519:/root/.ssh/id_ed25519:ro
|
||||
ports:
|
||||
# make the PCAP-over-IP port also available on the host on port 4200
|
||||
- 4200:4242
|
||||
environment:
|
||||
# Command to SSH into remote-host and execute tcpdump and filter out it's own SSH client traffic
|
||||
PCAP_COMMAND: ssh root@remote-host -o StrictHostKeyChecking=no 'IFACE=$$(ip route show to default | grep -Po1 "dev \K\w+") && BPF=$$(echo $$SSH_CLIENT | awk "{printf \"not (host %s and port %s and %s)\", \$$1, \$$2, \$$3;}") && tcpdump -U --immediate-mode -ni $$IFACE $$BPF -s 65535 -w -'
|
||||
# Command that will be executed by pcap-broker to read PCAP data.
|
||||
# Which is to SSH into `remote-host` and run tcpdump on eth0 and write PCAP data to stdout.
|
||||
# The `not port 22` BPF is necessary to avoid any traffic loops as the PCAP data is transferred over SSH.
|
||||
PCAP_COMMAND: |-
|
||||
ssh root@remote-host -oStrictHostKeyChecking=no
|
||||
tcpdump -U --immediate-mode -ni eth0 -s 65535 -w - not port 22
|
||||
|
||||
# Bind on 0.0.0.0 port 4242. From within the same Docker network you can reach it using the `container_name`
|
||||
# For example in another Docker service you can reach this pcap-broker using `pcap-broker-remote-host:4242`
|
||||
LISTEN_ADDRESS: "0.0.0.0:4242"
|
||||
ports:
|
||||
# This is optional, but makes the PCAP-over-IP port also available locally on the Docker host on port 4200.
|
||||
# Handy for debugging, for example: `nc -v localhost 4200 | tcpdump -nr -`
|
||||
- 127.0.0.1:4200:4242
|
||||
|
||||
Reference in New Issue
Block a user