How to capture packets for single docker container

• First, get pid of the container you are interested in

  docker inspect --format "{{ .State.Pid }}" "$CONTAINER_ID"
  

• Then enter the same network namespace

  nsenter -n -t "$PID"
  

• Finally, run tcpdump

From and for a workstation with Wireshark:

docker exec -ti <container id> cat /sys/class/net/eth0/iflink

28

ip link | grep 28

28: veth11b0a6c@if27: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default

You can bind to the network namespace of one container to another:

docker run -it --rm --net container:<container_name> \
  nicolaka/netshoot tcpdump ...

To see more about the netshoot image used above, see: https://github.com/nicolaka/netshoot