docker-compose.yaml

services:
  sensor:
    image: ubuntu:24.04
    container_name: sensor
    privileged: true
    cap_add:
      - NET_ADMIN
    networks:
      net_attacker:
        ipv4_address: 172.50.0.2
      net_victim:
        ipv4_address: 172.60.0.2
    command: bash -c "\
      apt update && apt install -y iproute2 iptables snort && \
      mkdir -p /etc/snort/rules && \
      echo 1 > /proc/sys/net/ipv4/ip_forward && \
      iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE && \
      iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT && \
      iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT && \
      echo 'ipvar HOME_NET 172.50.0.0/16' >> /etc/snort/snort.conf && \
      echo 'ipvar EXTERNAL_NET !172.50.0.0/16' >> /etc/snort/snort.conf && \
      echo 'alert tcp 172.50.0.0/16 any -> !172.50.0.0/16 any (msg:\"SYN Scan detected\"; flags:S; sid:1000001; rev:1;)' > /etc/snort/rules/local.rules && \
      echo 'include /etc/snort/rules/local.rules' >> /etc/snort/snort.conf && \
      snort -c /etc/snort/snort.conf -A console -i eth0 -i eth1"

  attacker:
    image: ubuntu:24.04
    container_name: attacker
    cap_add:
      - NET_ADMIN
    networks:
      net_attacker:
        ipv4_address: 172.50.0.3
    command: bash -c "\
      apt update && apt install -y iproute2 nmap && \
      ip route del default && ip route add default via 172.50.0.2 && \
      while true; do \
        echo 'Running SYN scan attack...' && \
        nmap -sS 172.60.0.3 && \
        sleep 10; \
      done"

  victim:
    image: ubuntu:24.04
    container_name: victim
    cap_add:
      - NET_ADMIN
    networks:
      net_victim:
        ipv4_address: 172.60.0.3
    command: bash -c "apt update && apt install -y iproute2 && sleep infinity"

networks:
  net_attacker:
    driver: bridge
    ipam:
      config:
        - subnet: 172.50.0.0/16
  net_victim:
    driver: bridge
    ipam:
      config:
        - subnet: 172.60.0.0/16