Docker duplicates UDP packets
You are seeing the transit of the same udp package, which is being forwarded:
netcat -(hello)-> host-interface -(hello)-> container-interface Each container has its own network interface. ngrep is watching both host-interfaces: the one that is usually eth0 and the one that is in the docker network, usually docker0.