Update README.md and docker-compose.yml example (#9)

This commit is contained in:
Yun Zheng Hu
2024-10-04 19:42:02 +02:00
committed by GitHub
parent 8f69ce3a49
commit 71303d38b8
2 changed files with 38 additions and 20 deletions

View File

@@ -1,16 +1,25 @@
version: "3.2"
services:
pcap-broker-remote-host:
image: pcap-broker:latest
container_name: pcap-broker-remote-host
restart: always
volumes:
# mount local user's SSH key into container
# Mount the private key into container that wil be used for SSH
# Ensure that on the `remote-host` the public key is in the /root/.ssh/authorized_keys file.
- ~/.ssh/id_ed25519:/root/.ssh/id_ed25519:ro
ports:
# make the PCAP-over-IP port also available on the host on port 4200
- 4200:4242
environment:
# Command to SSH into remote-host and execute tcpdump and filter out it's own SSH client traffic
PCAP_COMMAND: ssh root@remote-host -o StrictHostKeyChecking=no 'IFACE=$$(ip route show to default | grep -Po1 "dev \K\w+") && BPF=$$(echo $$SSH_CLIENT | awk "{printf \"not (host %s and port %s and %s)\", \$$1, \$$2, \$$3;}") && tcpdump -U --immediate-mode -ni $$IFACE $$BPF -s 65535 -w -'
# Command that will be executed by pcap-broker to read PCAP data.
# Which is to SSH into `remote-host` and run tcpdump on eth0 and write PCAP data to stdout.
# The `not port 22` BPF is necessary to avoid any traffic loops as the PCAP data is transferred over SSH.
PCAP_COMMAND: |-
ssh root@remote-host -oStrictHostKeyChecking=no
tcpdump -U --immediate-mode -ni eth0 -s 65535 -w - not port 22
# Bind on 0.0.0.0 port 4242. From within the same Docker network you can reach it using the `container_name`
# For example in another Docker service you can reach this pcap-broker using `pcap-broker-remote-host:4242`
LISTEN_ADDRESS: "0.0.0.0:4242"
ports:
# This is optional, but makes the PCAP-over-IP port also available locally on the Docker host on port 4200.
# Handy for debugging, for example: `nc -v localhost 4200 | tcpdump -nr -`
- 127.0.0.1:4200:4242