Disabling Docker ICC still allows raw ethernet communication between containers

Re:Disabling Docker ICC still allows raw ethernet communicat... by yanslookup on Tuesday February 20, 2018 @08:58PM (#16426212)

Is the idea that an attacker would enumerate mac addresses and scan for connections? Or is there a way for an attacker to discover neighboring container mac addresses?

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by andrewguenther on Tuesday February 20, 2018 @10:08PM (#16426516)

I'm curious about this as well. It seems like this would be pretty difficult to exploit in the real world.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Tuesday February 20, 2018 @11:14PM (#16426796)

I think some more research is needed here.

I'm wondering if containers could abuse ARP to find the neighboring addresses.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by andrewstuart on Wednesday February 21, 2018 @12:26AM (#16427076)

sudo arp-scan --interface=br0 --localnet --bandwidth=8192000 --numeric --retry=1

Should return mac addresses plus the associated IP address

although nmap would probably yield more interesting results.

[ Parent | on HN ]