Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie:

 # tcpdump -i any -n host 192.168.0.1

Is there any way to force tcpdump to show on which interface displayed packet was captured?

Update:

As more people confirmed this is probably not possible with vanilla tcpdump, can someone propose a solution to mentioned problem? Perhaps different sniffer?

General issue is as follows: On a system with 50 interfaces determine what is inbound interface for packets coming from specific ip address.

share|improve this question

5 Answers 5

I hope somebody is still interested in the solution to the problem. ;) We had the same issue in our company and I started writing a script for this.

I wrote a blog post about it with the source code and a screenshot.

I've also shared it below...

enter image description here

And the code: (Be sure to check my site for future updates)

#!/bin/sh
#===================================================================================
#
# FILE: dump.sh
# USAGE: dump.sh [-i interface] [tcpdump-parameters]
# DESCRIPTION: tcpdump on any interface and add the prefix [Interace:xy] in front of the dump data.
# OPTIONS: same as tcpdump
# REQUIREMENTS: tcpdump, sed, ifconfig, kill, awk, grep, posix regex matching
# BUGS:  ---
# FIXED: - In 1.0 The parameter -w would not work without -i parameter as multiple tcpdumps are started.
#        - In 1.1 VLAN's would not be shown if a single interface was dumped.
# NOTES: ---
#        - 1.2 git initial
# AUTHOR: Sebastian Haas
# COMPANY: pharma mall
# VERSION: 1.2
# CREATED: 16.09.2014
# REVISION: 22.09.2014
#
#===================================================================================

# When this exits, exit all background processes:
trap 'kill $(jobs -p) &> /dev/null && sleep 0.2 &&  echo ' EXIT
# Create one tcpdump output per interface and add an identifier to the beginning of each line:
if [[ $@ =~ -i[[:space:]]?[^[:space:]]+ ]]; then
    tcpdump -l $@ | sed 's/^/[Interface:'"${BASH_REMATCH[0]:2}"'] /' &
else
    for interface in $(ifconfig | grep '^[a-z0-9]' | awk '{print $1}')
    do
       tcpdump -l -i $interface -nn $@ | sed 's/^/[Interface:'"$interface"']    /' &
    done
fi
# wait .. until CTRL+C
wait
share|improve this answer

You can use the -e option to print the ethernet headers, then you can correlate the src/dst MAC addresses with your network interfaces ;).

share|improve this answer
for interface in `ifconfig | grep '^[a-z0-9]' | awk '{print $1}'`;do echo $interface;tcpdump -i $interface -nn -c 25;done

Adjust -c as needed.

share|improve this answer

Assuming this is on Linux, you could add an iptables rule to match the packet you are looking for and log it. Iptables log includes ingress and egress interfaces, among other things.

share|improve this answer

I don't know of any answer to that either. I find no option for it, can't recall ever seeing one, and am rather certain that the tcpdump format doesn't include an interface identifier. I think you'll have to start one tcpdump instance for each interface and log to respective files.

share|improve this answer
    
I concur. Typically when I'm sniffing traffic, I already know where the traffic is coming from or where it's going. If I have to figure that out, I have bigger fish to fry first... –  Corey S. Jan 20 '11 at 17:47
2  
I really need this functionality very often. I have several interfaces, lots of vlan interfaces, with IGP and BGP on top of this. Finding out how the packets are flowing is essential very often. I can manually check the outbound interface by examining the current routing table. But if I have to find the way packets are coming from the internet, sometimes I have to do blind checking, just by starting tcpdump on most probable interfaces. :( –  mdrozdziel Jan 21 '11 at 1:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.