I have a span feed coming in on an un-addressed interface of a linux (centos) box. eth4. The span contains several vlans.
I have an application which can grab packets from an interface promiscuously, but let's just say that the application isn't able to filter by vlan.
What I'd like to figure out a way to do -- and how is the real question -- is take the traffic off the interface and filter it down to just one vlan and present that limited amount of traffic back to the operating system as an "interface" that could be treated like eth4 is now.
Something like tcpdump -nn -i eth4 vlan 345 -w - | ...
but rather than piping that out to another command I need to present that to my application as an interface.
Also, ideally this trick would just copy the packets or better yet pointers to those packets in memory ... rather than recreating them as there will be some performance considerations.