Downloaded 28 times
Uploaded byDevOpsDays Tel Aviv
How Linux Processes Your Network Packet - Elazar Leibovich
This document summarizes the journey of a packet through the Linux networking stack both from outside a host to a Docker container and from the host to the container. It explains that each Docker container has its own network namespace containing its network interfaces like a virtual network card. It then demonstrates how to use iptables to redirect incoming packets to a container's port using DNAT, solving the problem of accessing a container service from outside the host. The document provides an overview of Linux networking components like bridges, veth pairs, and network namespaces to explain how Docker integrates with the host network stack.
More Related Content
Similar to How Linux Processes Your Network Packet - Elazar Leibovich
More from DevOpsDays Tel Aviv
How Linux Processes Your Network Packet - Elazar Leibovich
- 1. A Linux PacketJourney with Docker Elazar Leibovich DevOpsDays, Tel Aviv 2019
- 2. Who am I? ●Work ○ Storage @VAST Data ○ Virtualization @Ravello ○ Hadoop @Akamai ● Open Source ○ goproxy author ● elazarl @Twitter
- 3. Agenda ● A packet’slife cycle in Linux ● How it applies with containers ● Example problem & solution
- 4. Agenda ● A packet’slife cycle in Linux ● How it applies with containers ● Example problem & solution ● Overview of all network devices ● In depth in-kernel infrastructure
- 5.
- 6. I wrote anew service ● Collectd-like ● Metrics by UDP
- 7. … deployed iton my laptop With Docker docker run -d myapp
- 8. How do Iget there from the outside? docker run -tip8000:8000/udp myapp
- 9. How can wedo that in run time?
- 10. How can wedo that in run time?
- 11.
- 12. Network Namespace All networkcomponents in a box: ● Network devices ● Routing tables ● … 1 Docker container → 1 network namespace
- 13. Network Namespace Diagnosis Networknamespace ID
- 14. Packet from Hostto Container Docker Namespace Default namespace bridge Veth Pair Veth Pair docker0
- 15. Packet from Hostto Container Docker Namespace Default namespace bridge Veth Pair Veth Pair docker0
- 16. Packet from Hostto Container Docker Namespace Default namespace bridge Veth Pair Veth Pair docker0
- 17. Packet from Hostto Container Docker Namespace Default namespace bridge Veth Pair Veth Pair docker0
- 18. Packet from Hostto Container Docker Namespace Default namespace bridge Veth Pair Veth Pair docker0
- 19. Veth pair Diagnosis- ip link My ID Veth pair
- 20. Diagnosis of Interfacesin Bridge - ip link This is my bridgeThis is me
- 21. Bridge Diagnosis -/sys/class/net/
- 22. Back to OurProblem
- 23. Required Packet Journey DockerNamespace Default namespace bridge Veth Pair Veth Pair docker0 eth0
- 24. Required Packet Journey DockerNamespace Default namespace bridge Veth Pair Veth Pair docker0 eth0
- 25. Required Packet Journey DockerNamespace Default namespace bridge Veth Pair Veth Pair docker0 eth0
- 26. Required Packet Journey DockerNamespace Default namespace bridge Veth Pair Veth Pair docker0 eth0
- 27. Required Packet Journey DockerNamespace Default namespace bridge Veth Pair Veth Pair docker0 eth0
- 28. How can wedo that? What happens to incoming packets?
- 29. Ingress Packet Is thispacket for us? ● If it is - local delivery ● If it’s for someone else - forward it
- 30. Incoming packet toeth0 Docker Namespace Root namespace bridge Veth Pair Veth Pair docker0 eth0 172.17.0.1 10.25.0.1 172.17.0.2
- 31. Incoming packet toeth0 Docker Namespace Root namespace bridge Veth Pair Veth Pair docker0 eth0 172.17.0.1 10.25.0.1 172.17.0.2 Packet Destination IP 10.25.0.1
- 32. Incoming packet toeth0 Docker Namespace Root namespace bridge Veth Pair Veth Pair docker0 eth0 172.17.0.1 10.25.0.1 172.17.0.2 Destination == laptop IP 10.25.0.1
- 33. Local Delivery! Docker NamespaceRoot namespace bridge Veth Pair Veth Pair docker0 eth0 172.17.0.1 10.25.0.1 172.17.0.2
- 34. UdpNoPorts nstat | rgUdpNoPorts ● Formal documentation: The total number of received UDP datagrams for which there was no application at the destination port ● Simple words: The number of UDP packet dropped
- 35. What Would Happen? Wesend a packet to port 8000
- 36. What Would Happen? It’sdropped!
- 37. Moving a Packetto docker0
- 38. iptables ● Rule-based packetmanipulation ● In various point of the packet lifecycle
- 39. iptables ● Rule-based packetmanipulation ● In various point of the packet lifecycle ● We want to manipulate the packet’s destination before we route it!
- 41. Solution iptables -A PREROUTING-t nat # when? before routing
- 42. Solution iptables -A PREROUTING-t nat # when? before routing -i eth0 -p udp --dport 8000 # which? if pkt in eth0 from 8000
- 43. Solution iptables -A PREROUTING-t nat # when? before routing -i eth0 -p udp --dport 8000 # which? if pkt in eth0 from 8000 -j DNAT --to-destination 172.17.0.2:8000 # what? route to Docker
- 44. We’re done! ● Atfirst, we couldn’t send packets to a running container ● Docker said: “impossible” ● With a basic iptables command - we did it!
- 45. Summary ● You cando amazing things with Linux networking ● Available by default, on any server ● Basic knowledge is required
- 46. Questions? I have aquestion for you! Can you forward packets to a container only when no one accepts them on the host?@elazarl
- 47. More Information Linux packetjourney,napi, hardware queue,skb: https://youtu.be/6Fl1rsxk4JQ The Journey of a Packet Through the Linux Network Stack
- 48. Tools used lsd -the next gen ls command bat - A cat(1) clone with wings. column(1) ripgrep recursively searches directories for a regex pattern ip(8) rtacct(8) nstat(8)