Tcpdump inside a container netns from host namespaces
Sniff a container's traffic using host's tcpdump via its netns; no tools needed in image
PID=$(docker inspect -f '{{.State.Pid}}' <name>); nsenter -t $PID -n tcpdump -ni any -c 50
more namespaces
all 4 commands →
Inspect sockets in a process netns/mntns
nsenter -t $(pgrep -n <proc>) -n -m -p ss -tlnp
Isolated sandbox with unshare
unshare --net --pid --fork --mount-proc bash # then: ip netns add test; ip netns exec test ip a
Namespaces of a specific PID
lsns -p <pid>; readlink /proc/<pid>/ns/net /proc/1/ns/net # equal inode = same netns