I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.

Inbound traffic for that daemon could arrive on several different physical interfaces, however running tcpdump on loopback only shows traffic that also originates from the loopback, and won't show traffic that is routed there from the outside. (NB: even for that to work you have to monitor the original lo0 i/f, not the cloned one).

Is there any way that I capture traffic destined for that daemon on the loopback without having to monitor each physical port separately?

Post processing of pcaps with tcpmerge would be unwieldy, and there's also some special capture code running that is neither amenable to offline merging nor re-writing to handle multiple interfaces at the same time.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.