1

I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.

I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any definition of the interface identifier (eth0, eth10, br4, etc.)

Is there a way to instruct tcpdump to include interface info with each packet per line?

2

It turns out that this was essentially a duplicate that I was unable to find easily and the system didn't recommend. I thought I should give the answer here since it may not be 100% clear from the linked suggestion in the comment(s).

First, this contains the answer more-or-less, but you have to go to his German website to get a more up-to-date script. Further a simple copy and paste can present difficulties depending on your browser, etc.


ANSWER

What you will want to do is to use this script (version 1.3): dump.sh

It can be executed via: dump.sh [-i interface] [tcpdump-parameters]

For example, I was hunting for "incorrect" flags in a sizeable XenServer installation that were due to incorrect offloading attempts by the operating system. I was able to use the command with piping thus:

./dump.sh -v -nn | grep -i incorrect | egrep --line-buffered -v "Interface:lo:|eth3|vif21.4|xenbr4"
| improve this answer | |
  • With this (for me) packets are not being displayed in order (based on time). – Jaime Hablutzel Jun 20 at 17:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.