Duplicate tcpdump output in cooked capture mode from bridge interfaces

Question

I'm working with a system that has multiple bridge interfaces. I would like to monitor traffic on multiple interfaces, but tcpdump is capturing from both the master interface and its identical bridge, resulting in duplicate output for the same packets. I'm aware that the only way to make tcpdump operate on multiple interfaces is with cooked packet capture mode. How can I distinguish traffic on a bridge from the identical traffic on its master so that it can be filtered out?

Example of a capture that should have only two lines (one echo request and one echo reply):

root@UP-2033:~# tcpdump -qn -c 5 -i any 'icmp and net 10.2.64.0/27'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
22:52:32.387377 IP 10.2.64.9 > 10.2.64.1: ICMP echo request, id 40587, seq 1, length 64
22:52:32.387377 IP 10.2.64.9 > 10.2.64.1: ICMP echo request, id 40587, seq 1, length 64
22:52:32.387377 IP 10.2.64.9 > 10.2.64.1: ICMP echo request, id 40587, seq 1, length 64
22:52:32.387631 IP 10.2.64.1 > 10.2.64.9: ICMP echo reply, id 40587, seq 1, length 64
22:52:32.387660 IP 10.2.64.1 > 10.2.64.9: ICMP echo reply, id 40587, seq 1, length 64
5 packets captured
11 packets received by filter
0 packets dropped by kernel

Answer 1

Recent (I have 4.99.1) versions of tcpdump include the interface name in the output, so when tracing with -i any and there's a bridge involved (docker0 in this example), we see:

# tcpdump -i any net 172.17.0.0/16
20:37:49.636299 docker0 Out IP  172.17.0.1.37872 ...
20:37:49.636304 veth7c5eddd Out IP 172.17.0.1.37872 ...
20:37:49.636320 veth7c5eddd P   IP 172.17.0.2.webcache ...
20:37:49.636322 docker0 In  IP 172.17.0.2.webcache ...

This isn't exactly what you want, but you can postprocess the output to strip out traffic on interfaces in which you're not interested.

It looks like tcpdump records the interface index in the pcap file, so you could use a display filter in tshark/wireshark to isolate the traces you want.

For example, if I were perform the above capture to a file:

# tcpdump -i any -w packets -s 0 net 172.17.0.0/16

And given that I have:

# ip link show | egrep 'docker0|veth7c5eddd'
24: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
241: veth7c5eddd@if240: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default 

I could view only packets on docker0 like this:

# tshark -n -r packets -Y 'sll.ifindex==24'
    1   0.000000   172.17.0.1 → 172.17.0.2   TCP 80 48402 → 8080 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=2076236842 TSecr=0 WS=128
    4   0.000027   172.17.0.2 → 172.17.0.1   TCP 80 [TCP Out-Of-Order] 8080 → 48402 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM=1 TSval=2816273104 TSecr=2076236842 WS=128
    5   0.000037   172.17.0.1 → 172.17.0.2   TCP 72 48402 → 8080 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=2076236842 TSecr=2816273104
    7   0.000061   172.17.0.1 → 172.17.0.2   HTTP 151 GET / HTTP/1.1 
   10   0.000065   172.17.0.2 → 172.17.0.1   TCP 72 [TCP Dup ACK 9#1] 8080 → 48402 [ACK] Seq=1 Ack=80 Win=65152 Len=0 TSval=2816273104 TSecr=2076236842
   12   0.000169   172.17.0.2 → 172.17.0.1   TCP 235 [TCP Retransmission] 8080 → 48402 [PSH, ACK] Seq=1 Ack=80 Win=65152 Len=163 TSval=2816273104 TSecr=2076236842
   13   0.000178   172.17.0.1 → 172.17.0.2   TCP 72 48402 → 8080 [ACK] Seq=80 Ack=164 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
   16   0.000189   172.17.0.2 → 172.17.0.1   TCP 263 [TCP Retransmission] 8080 → 48402 [PSH, ACK] Seq=164 Ack=80 Win=65152 Len=191 TSval=2816273104 TSecr=2076236842
   17   0.000193   172.17.0.1 → 172.17.0.2   TCP 72 48402 → 8080 [ACK] Seq=80 Ack=355 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
   19   0.000232   172.17.0.1 → 172.17.0.2   TCP 72 48402 → 8080 [FIN, ACK] Seq=80 Ack=355 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
   22   0.040551   172.17.0.2 → 172.17.0.1   TCP 72 [TCP Dup ACK 21#1] 8080 → 48402 [ACK] Seq=355 Ack=81 Win=65152 Len=0 TSval=2816273144 TSecr=2076236842

You can see in that output that there aren't any duplicated packets.