Let's assume you have a running docker container with a webserver that serves requests. You want to see
the requests and responses it receives. You can use the --net container:<id> of the docker run command.
First, you have to discover the ID of the container that you want to monitor. Use docker ps to get it.
# On host
docker ps
Then start an alpine container and attach the network interface of the other container that you want to monitor traffic for:
# On host
docker run -it --net container:<id-of-other> alpine
You instruct docker to reuse the network interface of the other container, essentially giving you access to the its traffic.
In the alpine shell, install and use ngrep:
# In alpine container
apk add ngrep
ngrep -tpd any
Now, if you send network traffic to the other container, e.g. to a web server, you should see information about those requests. It might look like this:
T 2019/07/17 19:27:34.717566 172.17.0.1:44266 -> 172.17.0.2:5000 [AP] #30
GET /assets/js/bootstrap.min.js HTTP/1.1..Host: localhost..Connection: keep-alive..User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36..DNT: 1..Ac
cept: */*..Referer: http://localhost/..Accept-Encoding: gzip, deflate, br..Accept-Language: en-US,en;q=0.9,da;q=0.8,el;q=0.7,id;q=0.6,nb;q=0.5..Cookie: username-localhost-8888="2|1:0|10:1561106334|23:username-localhost-8888|44:N
mE1ZjczOWRkMjY1NDk5MTgwYjhlMGQ5MjQ0MDVlOWI=|c1693563f0aad21e6fd313397b2b8129fc804b5b59c114e3992d6ab9b83eaa67"; _xsrf=2|d2f00b1e|5cccf6ab5b54a9555120cb4aefcf7021|1561106334....
#####
T 2019/07/17 19:27:34.719175 172.17.0.2:5000 -> 172.17.0.1:44266 [AP] #35
HTTP/1.1 404 NOT FOUND..Server: gunicorn/19.9.0..Date: Wed, 17 Jul 2019 19:27:34 GMT..Connection: close..Content-Type: text/html..Content-Length: 232....
##
T 2019/07/17 19:27:34.719321 172.17.0.2:5000 -> 172.17.0.1:44266 [AP] #37
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<title>404 Not Found</title>.<h1>Not Found</h1>.<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.<
/p>.
###
T 2019/07/17 19:27:34.719936 172.17.0.2:5000 -> 172.17.0.1:44264 [AP] #40
HTTP/1.1 404 NOT FOUND..Server: gunicorn/19.9.0..Date: Wed, 17 Jul 2019 19:27:34 GMT..Connection: close..Content-Type: text/html..Content-Length: 232....
##
T 2019/07/17 19:27:34.720339 172.17.0.2:5000 -> 172.17.0.1:44264 [AP] #42
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<title>404 Not Found</title>.<h1>Not Found</h1>.<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.<
/p>.
##########
T 2019/07/17 19:27:34.754540 172.17.0.1:44268 -> 172.17.0.2:5000 [AP] #52
GET /assets/js/bootstrap.min.js HTTP/1.1..Host: localhost..Connection: keep-alive..User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36..DNT: 1..Ac
cept: */*..Referer: http://localhost/..Accept-Encoding: gzip, deflate, br..Accept-Language: en-US,en;q=0.9,da;q=0.8,el;q=0.7,id;q=0.6,nb;q=0.5..Cookie: username-localhost-8888="2|1:0|10:1561106334|23:username-localhost-8888|44:N
mE1ZjczOWRkMjY1NDk5MTgwYjhlMGQ5MjQ0MDVlOWI=|c1693563f0aad21e6fd313397b2b8129fc804b5b59c114e3992d6ab9b83eaa67"; _xsrf=2|d2f00b1e|5cccf6ab5b54a9555120cb4aefcf7021|1561106334....
##
T 2019/07/17 19:27:34.756442 172.17.0.2:5000 -> 172.17.0.1:44268 [AP] #54
HTTP/1.1 404 NOT FOUND..Server: gunicorn/19.9.0..Date: Wed, 17 Jul 2019 19:27:34 GMT..Connection: close..Content-Type: text/html..Content-Length: 232....
##
T 2019/07/17 19:27:34.756550 172.17.0.2:5000 -> 172.17.0.1:44268 [AP] #56
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<title>404 Not Found</title>.<h1>Not Found</h1>.<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.<
/p>.
####