Attacker IP shows as my gateway

[dolo]

win11 docker fresh install followed the instruction.
basicly running well.(except citrix network error, and I deleted the citrix section in docker compose file.)
And I found tpot-cowrie shows the attacker IP is my gateway(configured port forward in unifi ucg-ultra gateway).
I tried cowrie installed indepandently, and that works fine.
Any configuration I missed?
Thanks and forgive my poor English.

[t3chn0m4g3]

I have never seen Cowrie reporting a gateway IP address as the attacker IP, unless some weird NAT configuration was happening.

On the other hand macOS and Windows are not really meant for production use, as Docker Desktop is somewhat limited.

This might be one of the edge cases and I would recommend a Linux based VM. Unfortunately there is nothing more that we can do here.