docker communication

[filter-reset]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4 cores per host.

RAM

128, 256 and 384 gb

Storage for /

300gb+ for os

Storage for /nsm

30tb+

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I just need to confirm how docker images communicate to the other hosts in a distributed deployment. This is not deployed yet and really want to make sure we don't have any overlap in ip space. Is it just the docker ip 172.17.0.1 that will be seen or will they just communicate through the bridge / management interface ip? This is just a first round POC so please be patient with my silly questions. I could not find a definitive answer.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

172.17.0.x is an internal network used when one docker image connects to another docker image on the same host. If a docker image needs to connect to another host, then it should go out the host management interface and NAT to the management IP address. For more information, please see:
https://docs.securityonion.net/en/2.4/docker.html#networking-and-bridging