CODEWITHSUNDEEP
dockerwiresharktcpdump
kumar
kumar

Reputation: 9427

How do save tcpdump monitoring container for later analysis

I am using below command to monitor a single container. How can I extend this so that I can save the the tcp dump for later analysis using WireShark.

docker run -it --rm --net container:<container_name> \
  nicolaka/netshoot tcpdump ...

Upvotes: 1

Views: 1832

Answers (1)

graphite
graphite

Reputation: 2960

tcpdump has an option to send raw captured packets to stdout, send it to a file on host:

docker run -it --rm --net container:<> nickolaka/netchoot tcpdump -w - > packets.dump

or wireshark directly

docker run -it --rm --net container:<> nickolaka/netchoot -i any -w - | wireshark -k -i -

Upvotes: 3

Related Questions