Docker/Network Debugging - Revision history

Admin: /* april 19 debugging */

2017-09-23T18:54:48Z

april 19 debugging

← Older revision		Revision as of 18:54, 23 September 2017
Line 1:		Line 1:
	=~~april~~ 19 ~~debugging~~=		==April 19 Debugging==

	Cannot reach container, no netstat in the container to check if sockets are open.		Cannot reach container, no netstat in the container to check if sockets are open.
Line 60:		Line 60:

	Lesson learned: if you know what port you're scanning for with nmap, SPECIFY IT!		Lesson learned: if you know what port you're scanning for with nmap, SPECIFY IT!

			==Flags==

	{{DockerFlag}}		{{DockerFlag}}

Admin: /* april 19 debugging */

2017-08-16T20:21:45Z

april 19 debugging

← Older revision		Revision as of 20:21, 16 August 2017
Line 19:		Line 19:
	Went through some debugging with [[Iptables]] rules, and dropping a bunch of old crusty rules that were not being used/applied. This did not affect the firewall/connection in any way.		Went through some debugging with [[Iptables]] rules, and dropping a bunch of old crusty rules that were not being used/applied. This did not affect the firewall/connection in any way.

	~~Now, I'm getting really frustrated~~. Port 8888 simply will not open up to the outside world. Port 8081 works fine and is open from the container to the outside world (MongoExpress), but has no rules set in the firewall (incoming packets set to accept all). Same thing with port 28017, this port is also open. There is one rule for it, exactly the same as the one rule for port 8888.		Really frustrating. Port 8888 simply will not open up to the outside world. Port 8081 works fine and is open from the container to the outside world (MongoExpress), but has no rules set in the firewall (incoming packets set to accept all). Same thing with port 28017, this port is also open. There is one rule for it, exactly the same as the one rule for port 8888.

	Changing the port number to 9990 did not affect the outcome either. The container is still unreachable, even from the localhost. No port 9990 open anywhere, when scanning from a remote machine and when scanning from the local machine.		Changing the port number to 9990 did not affect the outcome either. The container is still unreachable, even from the localhost. No port 9990 open anywhere, when scanning from a remote machine and when scanning from the local machine.

	<s>Nothing working. No idea~~. Frustrating as hell~~.</s>		<s>Nothing working. No idea.</s>

	~~Yes,~~ of course, two minutes later everything just ~~MAGICALLY~~ works somehow, after the fifth time trying the ~~EXACT SAME SET OF COMMANDS~~.		And of course, two minutes later, everything just magically works somehow, after the fifth time trying the ''exact same set of commands.''

	Nmap was not helping: port 9990 was open, but was not showing up in any nmap scans. See:		Nmap was not helping here: port 9990 was ''open'' but was not showing up in any nmap scans. See:

	<pre>		<pre>
Line 59:		Line 59:
	</pre>		</pre>

			Lesson learned: if you know what port you're scanning for with nmap, SPECIFY IT!

	{{DockerFlag}}		{{DockerFlag}}

Admin: Created page with "=april 19 debugging= Cannot reach container, no netstat in the container to check if sockets are open. Troubleshooting: [http://stackoverflow.com/questions/27806631/docker-r..."

2017-05-07T08:14:19Z

Created page with "=april 19 debugging= Cannot reach container, no netstat in the container to check if sockets are open. Troubleshooting: [http://stackoverflow.com/questions/27806631/docker-r..."

New page

=april 19 debugging=

Cannot reach container, no netstat in the container to check if sockets are open.

Troubleshooting: [http://stackoverflow.com/questions/27806631/docker-rails-app-fails-to-be-served-curl-56-recv-failure-connection-reset here] and [http://stackoverflow.com/questions/40350456/docker-any-way-to-list-open-sockets-inside-a-running-docker-container here] are both useful pages.

To run netstat in the container, even if netstat is not available in the container, run

<pre>
$ sudo nsenter -t `docker inspect -f '{{.State.Pid}}'` -n netstat
</pre>

Can also use docker port command to check which ports are open and exposed to the host:

<pre>
$ docker port container_name
</pre>

Went through some debugging with [[Iptables]] rules, and dropping a bunch of old crusty rules that were not being used/applied. This did not affect the firewall/connection in any way.

Now, I'm getting really frustrated. Port 8888 simply will not open up to the outside world. Port 8081 works fine and is open from the container to the outside world (MongoExpress), but has no rules set in the firewall (incoming packets set to accept all). Same thing with port 28017, this port is also open. There is one rule for it, exactly the same as the one rule for port 8888.

Changing the port number to 9990 did not affect the outcome either. The container is still unreachable, even from the localhost. No port 9990 open anywhere, when scanning from a remote machine and when scanning from the local machine.

<s>Nothing working. No idea. Frustrating as hell.</s>

Yes, of course, two minutes later everything just MAGICALLY works somehow, after the fifth time trying the EXACT SAME SET OF COMMANDS.

Nmap was not helping: port 9990 was open, but was not showing up in any nmap scans. See:

<pre>
$ nmap reidmachine.party

Starting Nmap 6.47 ( http://nmap.org ) at 2017-04-19 23:02 UTC
Nmap scan report for reidmachine.party (96.126.102.36)
Host is up (0.00082s latency).
rDNS record for 96.126.102.36: li335-36.members.linode.com
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
8081/tcp open blackice-icecap

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
</pre>

but when port 9990 is specified, it discovers it:

<pre>
$ nmap -p 9990 reidmachine.party

Starting Nmap 6.47 ( http://nmap.org ) at 2017-04-19 23:03 UTC
Nmap scan report for reidmachine.party (96.126.102.36)
Host is up (0.00046s latency).
rDNS record for 96.126.102.36: li335-36.members.linode.com
PORT STATE SERVICE
9990/tcp open osm-appsrvr

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
</pre>

{{DockerFlag}}