Is the idea that an attacker would enumerate mac addresses and scan for connections? Or is there a way for an attacker to discover neighboring container mac addresses?
I'm wondering if containers could abuse ARP to find the neighboring addresses.
Should return mac addresses plus the associated IP address
although nmap would probably yield more interesting results.