Recent (I have 4.99.1) versions of tcpdump
include the interface name in the output, so when tracing with -i any
and there's a bridge involved (docker0
in this example), we see:
# tcpdump -i any net 172.17.0.0/16
20:37:49.636299 docker0 Out IP 172.17.0.1.37872 ...
20:37:49.636304 veth7c5eddd Out IP 172.17.0.1.37872 ...
20:37:49.636320 veth7c5eddd P IP 172.17.0.2.webcache ...
20:37:49.636322 docker0 In IP 172.17.0.2.webcache ...
This isn't exactly what you want, but you can postprocess the output to strip out traffic on interfaces in which you're not interested.
It looks like tcpdump records the interface index in the pcap file, so you could use a display filter in tshark/wireshark to isolate the traces you want.
For example, if I were perform the above capture to a file:
# tcpdump -i any -w packets -s 0 net 172.17.0.0/16
And given that I have:
# ip link show | egrep 'docker0|veth7c5eddd'
24: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
241: veth7c5eddd@if240: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
I could view only packets on docker0
like this:
# tshark -n -r packets -Y 'sll.ifindex==24'
1 0.000000 172.17.0.1 → 172.17.0.2 TCP 80 48402 → 8080 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=2076236842 TSecr=0 WS=128
4 0.000027 172.17.0.2 → 172.17.0.1 TCP 80 [TCP Out-Of-Order] 8080 → 48402 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM=1 TSval=2816273104 TSecr=2076236842 WS=128
5 0.000037 172.17.0.1 → 172.17.0.2 TCP 72 48402 → 8080 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=2076236842 TSecr=2816273104
7 0.000061 172.17.0.1 → 172.17.0.2 HTTP 151 GET / HTTP/1.1
10 0.000065 172.17.0.2 → 172.17.0.1 TCP 72 [TCP Dup ACK 9#1] 8080 → 48402 [ACK] Seq=1 Ack=80 Win=65152 Len=0 TSval=2816273104 TSecr=2076236842
12 0.000169 172.17.0.2 → 172.17.0.1 TCP 235 [TCP Retransmission] 8080 → 48402 [PSH, ACK] Seq=1 Ack=80 Win=65152 Len=163 TSval=2816273104 TSecr=2076236842
13 0.000178 172.17.0.1 → 172.17.0.2 TCP 72 48402 → 8080 [ACK] Seq=80 Ack=164 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
16 0.000189 172.17.0.2 → 172.17.0.1 TCP 263 [TCP Retransmission] 8080 → 48402 [PSH, ACK] Seq=164 Ack=80 Win=65152 Len=191 TSval=2816273104 TSecr=2076236842
17 0.000193 172.17.0.1 → 172.17.0.2 TCP 72 48402 → 8080 [ACK] Seq=80 Ack=355 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
19 0.000232 172.17.0.1 → 172.17.0.2 TCP 72 48402 → 8080 [FIN, ACK] Seq=80 Ack=355 Win=64128 Len=0 TSval=2076236842 TSecr=2816273104
22 0.040551 172.17.0.2 → 172.17.0.1 TCP 72 [TCP Dup ACK 21#1] 8080 → 48402 [ACK] Seq=355 Ack=81 Win=65152 Len=0 TSval=2816273144 TSecr=2076236842
You can see in that output that there aren't any duplicated packets.