I have a daemon listening on a virtual IP address attached to a cloned loopback interface (
lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, however running
tcpdump on loopback only shows traffic that also originates from the loopback, and won't show traffic that is routed there from the outside. (NB: even for that to work you have to monitor the original
lo0 i/f, not the cloned one).
Is there any way that I capture traffic destined for that daemon on the loopback without having to monitor each physical port separately?
Post processing of pcaps with
tcpmerge would be unwieldy, and there's also some special capture code running that is neither amenable to offline merging nor re-writing to handle multiple interfaces at the same time.