News for hackers. Stuff that matters.

A comment on Disabling Docker ICC still allows raw ethernet communication between containers. Parent comment

Re:Disabling Docker ICC still allows raw ethernet communicat... by eigengrau on Wednesday February 21, 2018 @04:59AM (#16428282)
> Even if you used ebtables to filter out containers talking to each others' MAC addresses, wouldn't they be able to send broadcast or multicast packets to communicate with each other?

ebtables supports «broadcast» as a destination to match ethernet frames on.

   ebtables … -d broadcast
which is equivalent to

  ebtables … -d ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff
[ Parent | on HN ]

There are no comments on this comment yet.