Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capturing Traffic for IP #224

Open
GSTovey opened this issue Jan 16, 2025 · 1 comment
Open

Capturing Traffic for IP #224

GSTovey opened this issue Jan 16, 2025 · 1 comment

Comments

@GSTovey
Copy link

GSTovey commented Jan 16, 2025

I am a beginner in this project, and when I use this project to scrape traffic, I choose to use commands in the Dockerfile as
CMD ["ptcpdump", "-i", "any", "--container-name", "tor_producer", "-w", "/data/capture.pcap", "-v"]
However, when I parsed the obtained PCAP file, I found that both its src_ip and dst_ip were 127.0.0.1, which is not the result I wanted.
Then I modified the command to
CMD ["ptcpdump", "-i", "any", "--container-name", "tor_producer", "-w", "/data/capture.pcap", "-v", "eth0", "not", "dst", "127.0.0.1", "and", "not", "src", "127.0.0.1"]
It still doesn't work. I wonder how do I need to modify the command?

@mozillazg
Copy link
Owner

@GSTovey How about running the command below:

docker run --privileged --rm -t --net=host --pid=host \
  -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
  -v /var/run:/var/run:ro \
  -v /run:/run:ro \
  -v `pwd`:/ptcpdump \
  quay.io/ptcpdump/ptcpdump:latest ptcpdump -i any --container-name tor_producer -v --print -w /ptcpdump/capture.pcap

Is the result what you expected?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants