container_id="mycontainerid" container_pid="$(docker inspect --format "{{ .State.Pid }}" "${container_id}")" nsenter -n -t "${container_pid}" exit
After executing nsenter all commands that support namespaces see the network interfaces like they are in the container. Example commands: ip, tcpdump. With exit the namespace can be left to see the network interfaces from the host system again.
tcpdump has to be installed on the host system and not in the container.
container_id="mycontainerid" container_pid="$(docker inspect --format "{{ .State.Pid }}" "${container_id}")" nsenter -n -t "${container_pid}" tcpdump -nn -i eth0