5 ms·

This is great, I was already doing research in that area for my tool. What about a container that writes to the /etc/hosts? It won’t emit DNS queries at all and

This is great, I was already doing research in that area for my tool. What about a container that writes to the /etc/hosts? It won’t emit DNS queries at all and because of that the connections will show up as bare IPs without domain. That’s a known trick, already exploited (collusion.wiki mentioned here on HN two days ago)

infomaniac777 10d ago
Good point. Yeah, there will not be a DNS name mapping for such an IP. TBF, that's also gonna be the case if there is a hardcoded IP inside the container. With that said, the actual network connection(w/o the DNS name resolution) will still show up here because ultimately it has to open a socket if/when it connects. It will still give you that attributed to the container in dsnitch for further analysis.
- coder-pm 9d ago
  Hm and does name mapping still work if the user is using docker compose? it creates a user-defined network and resolv.conf is 127.0.0.11 rather than the host resolver