How to determine which NIC data/traffic is using?

Question

How to determine which NIC data/traffic is using? To make sure routing is correct.

Answer 1

How to determine which NIC data/traffic is using?

If I was in doubt, I would check the routing tables and things like other people mentioned, but then I would fire up my sniffer (wireshark, tcpdump) and perform a capture on the interface in question while I generate some traffic to actually determine if it is doing what it is supposed to be doing.

Answer 2

You can use IPTRAF, which I've found is nice, and will let you see the data that is traveling between each device in real-time.

Answer 3

Zoredache comment about sniffer is, I think, the gold standard.

Another options: use the ifconfig command to see if the number of transmitted and received packets on the interface is increasing. Also, can see if any other interfaces are being used.

For shell scripts, you may be able to query the proc data structures directly.

Answer 4

To find out which route the traffic is taking to a certain address over TCP, use the 'Trace Route' tool.

For Windows, the command is:

tracert [host]

Where [host] is what you want to check, say google.com or mymachine.domain.local.

By looking at the first hop, you'll know where it went. For example:

C:\Users\Mark>tracert google.com

Tracing route to google.com [66.102.11.104]
over a maximum of 30 hops:

  1    14 ms    13 ms    14 ms  nexthop.nsw.iinet.net.au [203.55.231.88]

Tells me that my traffic to Google is going over my iiNet NIC, but if I tracert 118.82.45.35 (where I have a static route going to a different NIC) I see:

Tracing route to 118.82.45.35 over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms  192.168.161.1
  2    29 ms    28 ms    28 ms  lns20.syd6.internode.on.net [150.101.199.159]

Which tells me that it's going to a different gateway (and different NIC), and over my Internode internet connection.

-- Update --

If this is not enough evidence, or the first hops are the same, then your only option will be to do as Zoredache said, and use WireShark and watch the actual packets flow through the NIC.