Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to determine which NIC data/traffic is using? To make sure routing is correct.

share|improve this question

How to determine which NIC data/traffic is using?

If I was in doubt, I would check the routing tables and things like other people mentioned, but then I would fire up my sniffer (wireshark, tcpdump) and perform a capture on the interface in question while I generate some traffic to actually determine if it is doing what it is supposed to be doing.

share|improve this answer

You can use IPTRAF, which I've found is nice, and will let you see the data that is traveling between each device in real-time.

share|improve this answer
Worth noting that IPTRAF is *nix only, AFAIK – Mark Henderson Jan 7 '10 at 23:56

Zoredache comment about sniffer is, I think, the gold standard.

Another options: use the ifconfig command to see if the number of transmitted and received packets on the interface is increasing. Also, can see if any other interfaces are being used.

For shell scripts, you may be able to query the proc data structures directly.

share|improve this answer
Note also IFCONFIG is also a *nix utiltity, for future reference – Mark Henderson Jan 9 '10 at 21:11

To find out which route the traffic is taking to a certain address over TCP, use the 'Trace Route' tool.

For Windows, the command is:

tracert [host]

Where [host] is what you want to check, say or mymachine.domain.local.

By looking at the first hop, you'll know where it went. For example:


Tracing route to []
over a maximum of 30 hops:

  1    14 ms    13 ms    14 ms []

Tells me that my traffic to Google is going over my iiNet NIC, but if I tracert (where I have a static route going to a different NIC) I see:

Tracing route to over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms
  2    29 ms    28 ms    28 ms []

Which tells me that it's going to a different gateway (and different NIC), and over my Internode internet connection.

-- Update --

If this is not enough evidence, or the first hops are the same, then your only option will be to do as Zoredache said, and use WireShark and watch the actual packets flow through the NIC.

share|improve this answer
this doesn't tell me what nic it left my pc on. Or am i missing something? – mattlandis Jan 8 '10 at 1:15
You can tell which NIC by looking at the first hop. Each NIC will have a different gateway (and if they don't, they should), so you should see the gateway's IP address there. – Mark Henderson Jan 8 '10 at 1:50
I just checked and tracert does not help me at all. – mattlandis Jan 8 '10 at 12:19
If you hve two nics on differet subnets, then there should be a clear difference between the two traces, unless your network is configured in a highly peculiar manner. – Mark Henderson Jan 9 '10 at 21:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.