How to display interface in tcpdump output flow?

Question

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie:

 # tcpdump -i any -n host 192.168.0.1

Is there any way to force tcpdump to show on which interface displayed packet was captured?

Update:

As more people confirmed this is probably not possible with vanilla tcpdump, can someone propose a solution to mentioned problem? Perhaps different sniffer?

General issue is as follows: On a system with 50 interfaces determine what is inbound interface for packets coming from specific ip address.

Answer 1

I don't know of any answer to that either. I find no option for it, can't recall ever seeing one, and am rather certain that the tcpdump format doesn't include an interface identifier. I think you'll have to start one tcpdump instance for each interface and log to respective files.

Answer 2

Assuming this is on Linux, you could add an iptables rule to match the packet you are looking for and log it. Iptables log includes ingress and egress interfaces, among other things.

Answer 3

for interface in `ifconfig | grep '^[a-z0-9]' | awk '{print $1}'`;do echo $interface;tcpdump -i $interface -nn -c 25;done

Adjust -c as needed.