文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
社区首页 >问答首页 >为什么docker0需要杂乱的模式？

问为什么docker0需要杂乱的模式？
EN

Stack Overflow用户
提问于 2020-03-24 03:06:26
回答 1查看 1K关注 0票数 2

使用docker时，在我的主机上创建默认桥接模式的容器。

docker run --name bb -dit busybox

现在我得到了IP: 172.17.0.2

当我平这个ip时，不起作用

但是，当我使用tcpdump作为接口docker0时，ping工作*

或者将docker0放到混杂模式中，ping也能工作*

我的问题是：为什么我需要将docker0置于混杂模式(只有这个主机)，其他主机不需要这样做

我的iptables结果：

代码语言：javascript
复制
Chain INPUT (policy ACCEPT 29031 packets, 8703K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  eth0   *       <hide>               192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       <hide>         policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       <hide>               192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       <hide>          policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       10.10.10.0/24        192.168.0.0/24       policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    192.168.0.0/24       10.10.10.0/24        policy match dir out pol ipsec reqid 8 proto 50
   56 11716 ACCEPT     all  --  eth0   *       <hide>               10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
   81  6292 ACCEPT     all  --  *      eth0    10.10.1.0/24         <hide>         policy match dir out pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  eth0   *       <hide>               10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
    0     0 ACCEPT     all  --  *      eth0    10.10.1.0/24         <hide>          policy match dir out pol ipsec reqid 8 proto 50
 1320 53255 ACCEPT     all  --  eth0   *       10.10.10.0/24        10.10.1.0/24         policy match dir in pol ipsec reqid 8 proto 50
 1344  104K ACCEPT     all  --  *      eth0    10.10.1.0/24         10.10.10.0/24        policy match dir out pol ipsec reqid 8 proto 50
 2218 1192K DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2218 1192K DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  docker_gwbridge docker_gwbridge  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 27320 packets, 8507K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker_gwbridge !docker_gwbridge  0.0.0.0/0            0.0.0.0/0
 2218 1192K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  *      docker_gwbridge  0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
54846   16M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
--------------------------------------------------------------------------------
nat
Chain PREROUTING (policy ACCEPT 6853 packets, 399K bytes)
 pkts bytes target     prot opt in     out     source               destination
 5353  327K DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 5353 packets, 327K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 57595 packets, 3457K bytes)
 pkts bytes target     prot opt in     out     source               destination
    3   252 DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 57970 packets, 3481K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0
    2   224 MASQUERADE  all  --  *      !docker_gwbridge  172.18.0.0/16        0.0.0.0/0

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     all  --  docker_gwbridge *       0.0.0.0/0            0.0.0.0/0
代码语言：javascript
复制
NETWORK ID          NAME                DRIVER              SCOPE
a20b11f6afaf        bridge              bridge              local
b39d1b268305        docker_gwbridge     bridge              local
5870d314fa6f        host                host                local
e0883dc1d6d0        none                null                local

ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:15:5d:00:02:10 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.10.1.3/24 brd 10.10.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe00:210/64 scope link
       valid_lft forever preferred_lft forever
3: docker_gwbridge: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
    link/ether 02:42:0b:48:8e:44 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global docker_gwbridge
       valid_lft forever preferred_lft forever
    inet6 fe80::42:bff:fe48:8e44/64 scope link
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 02:42:f8:5d:0a:13 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:f8ff:fe5d:a13/64 scope link
       valid_lft forever preferred_lft forever
8: vethca01e3e@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP
    link/ether 62:a0:50:02:72:94 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::60a0:50ff:fe02:7294/64 scope link
       valid_lft forever preferred_lft forever

tcpdump -vv -ni vethca01e3e

代码语言：javascript
复制
tcpdump: listening on vethca01e3e, link-type EN10MB (Ethernet), capture size 65535 bytes
12:20:47.972359 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:47.972397 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:48.973716 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:48.973750 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28
12:20:49.975718 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:20:49.975742 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.17.0.2 is-at 02:42:ac:11:00:02, length 28

tcpdump -vvv -p -ni docker0

代码语言：javascript
复制
tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:21:05.458191 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:06.459709 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28
12:21:07.461705 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.17.0.2 tell 172.17.0.1, length 28

veth重播arp，但docker0忽略它

docker
networking
iptables
EN

回答 1

Stack Overflow用户

发布于 2020-04-28 03:25:02

我也遇到了同样的问题。我发现如果删除docker0接口并重新启动对接程序，就可以解决我的问题。

票数 0
EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://stackoverflow.com/questions/60824424

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 粤公网安备44030502008569号

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档