Have you tried this: https://stackoverflow.com/questions/39362730/how-to-capture-packets-for-single-docker-container
or this https://stackoverflow.com/questions/37860936/find-out-which-network-interface-belongs-to-docker-container ?

Hope it helps :)

from ngsdn-tutorial.

Thanks for the quick reply...

I have looked into the first link. For example, below are two switch interfaces in the mininet VM:

"""
sdn@tutorial-vm:~/ngsdn-tutorial$ docker exec mininet ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.20.0.2 netmask 255.255.0.0 broadcast 172.20.255.255
ether 02:42:ac:14:00:02 txqueuelen 0 (Ethernet)
RX packets 57 bytes 7350 (7.1 KiB)

leaf1-eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 8e:52:be:7c:bf:ee txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)

leaf1-eth2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether c2:b3:47:c3:fd:bb txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
....
"""

From my host (as shown below), it appears that veth8f695be is mapped to leaf1-eth1, great! However, my host does not have a mapping for leaf1-eth2. In fact, the host VM only have two such "veth" interfaces.

sdn@tutorial-vm:/ngsdn-tutorial$ docker exec -it mininet cat /sys/class/net/leaf1-eth1/iflink
9
sdn@tutorial-vm:/ngsdn-tutorial$ ip ad | grep 9
link/ether 08:00:27:86:96:bc brd ff:ff:ff:ff:ff:ff
inet6 fe80::a00:27ff:fe86:96bc/64 scope link
link/ether 02:42:0d:c5:fc:9d brd ff:ff:ff:ff:ff:ff
link/ether 02:42:4d:41:09:1d brd ff:ff:ff:ff:ff:ff
inet6 fe80::42:4dff:fe41:91d/64 scope link
20: veth8f695be@if19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-1c3bcd4640a0 state UP group default

sdn@tutorial-vm:/ngsdn-tutorial$ docker exec -it mininet cat /sys/class/net/leaf1-eth2/iflink
13
sdn@tutorial-vm:/ngsdn-tutorial$ ip ad | grep 13

I did come across the second link in Google. However, from a quick look, it appears that the tool allows the use of perhaps tcpdump to capture the pcap for an interface, and then you can use wireshark to view the pcap log (Perhaps I can do the same using docker exec?).

For some reason, I assumed there were instructions in the tutorial to streamline wireshark such that you can fire it up on the host, and magically access the mininet switch interfaces (leaf1-eth1, leaf1-eth2, etc.)?

Thoughts?

from ngsdn-tutorial.

Ok so let's see. I found this capture in Exercise 7. Could you do something similar?

from ngsdn-tutorial.

That will suffice :)

I'm not a bash expert, but I went ahead and inserted a minor tweak to specify the "host" and "interface" on the command line (e.g. util/mn-pcap leaf1 eth1): perhaps some folks may find this useful. Below is the updated code:

#!/bin/bash

DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"

# Require two arguments
if [ -z $2 ]; then
  echo "usage: $0 host interface"
  exit 1
fi

host=$1
iface=$2
host_iface=$host-$iface
file=${host_iface}.pcap

set -e

echo "*** Starting tcpdump on ${host}... Ctrl-c to stop capture"
echo "*** Pcap file will be written in ngsdn-tutorial/tmp/${file}"
docker exec -it mininet /mininet/host-cmd $host tcpdump -i $host_iface -w /tmp/"${file}"

if [ -x "$(command -v wireshark)" ]; then
  echo "*** Opening wireshark... Ctrl-c to quit"
  wireshark "${DIR}/../tmp/${file}"
fi

from ngsdn-tutorial.