SO2 Docker non NAT to Github

[squares-ui]

FYI - Using SO2 I was looking through logs, and I've seen 172.17.0.6 reaching out to GitHub without going through NAT/Proxy
I downloaded the packets and found the MAC address, which in this network points to the SO2 master.
172.17.0.6 appears to be Grafana

[root@so2 admin]# docker inspect -f '{{.Name}} - {{.NetworkSettings.IPAddress }}' $(docker ps -aq)
/so-grafana - 172.17.0.6

I'm guessing Grafana just doing local updates, but still worth reporting. HTH

Andy

{
  "_index": "so2:so-zeek-2021.03.24",
  "_type": "_doc",
  "_id": "0hjgZHgBqpru93IXyEi6",
  "_version": 1,
  "_score": null,
  "_source": {
    "server": {
      "port": "443",
      "bytes": 0,
      "ip": "185.199.110.133",
      "ip_bytes": 0,
      "packets": 0
    },
    "log": {
      "file": {
        "path": "/nsm/zeek/logs/current/conn.log"
      },
      "offset": 1475735,
      "id": {
        "uid": "Ca2jHC1doNXvKqxj72"
      }
    },
    "destination": {
      "geo": {
        "continent_name": "North America",
        "country_iso_code": "US",
        "timezone": "America/Chicago",
        "ip": "185.199.110.133",
        "country_name": "United States",
        "location": {
          "lon": -97.822,
          "lat": 37.751
        }
      },
      "port": 443,
      "ip": "185.199.110.133"
    },
    "source": {
      "port": 47964,
      "ip": "172.17.0.6"
    },
    "network": {
      "community_id": "1:4gOAQuoJBsozvKxS+PGKm93WwuE=",
      "bytes": 0,
      "transport": "tcp"
    },
    "ingest": {
      "timestamp": "2021-03-24T15:35:50.974Z"
    },
    "observer": {
      "name": "so2sensor"
    },
    "ecs": {
      "version": "1.6.0"
    },
    "@version": "1",
    "client": {
      "port": "47964",
      "bytes": 0,
      "ip": "172.17.0.6",
      "ip_bytes": 80,
      "packets": 2
    },
    "connection": {
      "state_description": "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)",
      "bytes": {
        "missed": 0
      },
      "state": "OTH",
      "history": "R",
      "local": {
        "responder": false,
        "originator": true
      }
    },
    "event": {
      "duration": 0.000006198883056640625,
      "module": "zeek",
      "category": "network",
      "dataset": "conn"
    },
    "message": "{\"ts\":\"2021-03-24T15:35:43.801622Z\",\"uid\":\"Ca2jHC1doNXvKqxj72\",\"id.orig_h\":\"172.17.0.6\",\"id.orig_p\":47964,\"id.resp_h\":\"185.199.110.133\",\"id.resp_p\":443,\"proto\":\"tcp\",\"duration\":6.198883056640625e-06,\"orig_bytes\":0,\"resp_bytes\":0,\"conn_state\":\"OTH\",\"local_orig\":true,\"local_resp\":false,\"missed_bytes\":0,\"history\":\"R\",\"orig_pkts\":2,\"orig_ip_bytes\":80,\"resp_pkts\":0,\"resp_ip_bytes\":0,\"community_id\":\"1:4gOAQuoJBsozvKxS+PGKm93WwuE=\"}",
    "tags": [
      "beats_input_codec_plain_applied"
    ],
    "@timestamp": "2021-03-24T15:35:43.801Z"
  },
  "fields": {
    "@timestamp": [
      "2021-03-24T15:35:43.801Z"
    ],
    "Push to TheHive": [
      "https://192.168.1.20/soctopus/thehive/case/0hjgZHgBqpru93IXyEi6"
    ]
  },
  "sort": [
    1616600143801
  ]
}

[squares-ui]

On inspection, the RST is from 172 -> Docker, so maybe the outbound request is ok, but the inbound SYN/ACK isn't going through NAT ok

[squares-ui]

A little sneak peak of what I'm releasing with Squares-UI, here is what a profile looks like of traffic to the destination 185.199.108.133

And here is a similar profile of traffic to source 172.17.0.6

[squares-ui]