能否在Windows Docker容器内捕获TCP数据包？（基于windowsservercore镜像）

Let's break down why you're hitting those errors and walk through actionable solutions to verify if traffic is reaching your container.

Why You're Seeing These Errors #

The root issue boils down to how Windows containers isolate network resources:

• netsh trace error 0x800106d9: Windows containers (especially those using Hyper-V isolation) don't include the inbox Windows Packet Capture (WPC) kernel driver by default. This driver is required for netsh trace to work.
• New-NetEventSession general error: NetEventSession relies on ETW (Event Tracing for Windows) components that are restricted or missing in container environments, especially Hyper-V isolated ones.

Solutions to Capture Traffic in/For Windows Containers #

1. Switch to Process Isolation (If Possible) #

If your host and container image share the same Windows Server version (e.g., both Windows Server 2019 LTSC), you can use process isolation to share the host's kernel and its WPC driver.

Steps:

• Stop your existing container:

  docker stop <container-id>
  

• Restart the container with process isolation:

  docker run -d --isolation=process microsoft/windowsservercore:<your-version> <your-app-command>
  

• Exec into the container and start tracing:

  docker exec -it <container-id> powershell
  netsh trace start capture=yes tracefile=c:\container-trace.etl
  

• When done, stop the trace and convert it to a Wireshark-compatible format:

  netsh trace stop
  netsh trace convert input=c:\container-trace.etl output=c:\container-trace.cap
  

2. Use User-Space Capture Tools in Hyper-V Isolated Containers #

If you must use Hyper-V isolation (e.g., version mismatch between host and container), use third-party user-space tools like Npcap and Tshark:

Steps:

1. Exec into your container:

   docker exec -it <container-id> powershell
   

2. Download and install Npcap (required for packet capture):

   Invoke-WebRequest -Uri https://nmap.org/npcap/dist/npcap-1.79.exe -OutFile c:\npcap.exe
   c:\npcap.exe /S  # Silent install
   

3. Download and install Wireshark (we only need the tshark command-line tool):

   Invoke-WebRequest -Uri https://www.wireshark.org/download/win64/all-versions/Wireshark-4.0.8-win64.exe -OutFile c:\wireshark.exe
   c:\wireshark.exe /S /desktopicon=no /quicklaunchicon=no /startmenushortcut=no
   

4. List available network interfaces to capture from:

   tshark -D
   

5. Start capturing traffic (replace <interface-number> with your target interface):

   tshark -i <interface-number> -w c:\container-capture.pcap
   

3. Capture Container Traffic from the Host #

If you don't strictly need to capture from inside the container, you can trace the container's network endpoint directly from the host:

Steps:

1. Get your container's endpoint ID:

   docker inspect <container-id> | Select-String -Pattern "EndpointID"
   

2. Find the corresponding host network adapter (it will include the endpoint ID in its name):

   Get-NetAdapter | Where-Object Name -Match "HNS Endpoint"
   

3. Start tracing on that adapter from the host:

   netsh trace start capture=yes interface="<adapter-name>" tracefile=c:\host-container-trace.etl
   

Key Notes #

• Process isolation only works if your host and container image have identical Windows versions (e.g., Windows Server 2019 host ↔ windowsservercore:ltsc2019 container).
• If your container doesn't have internet access, copy the Npcap/Wireshark install files to the container first using docker cp:

  docker cp npcap.exe <container-id>:c:\
  

内容的提问来源于stack exchange，提问作者Duncan