Home / server / Questions / 899535
In Process
ylluminate
Asked: 2018-03-02 10:59:37 +0800 CST

When using tcpdump's `-i any` argument, how to get also interface name inline? [duplicate]

  • 772

I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.

I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any definition of the interface identifier (eth0, eth10, br4, etc.)

Is there a way to instruct tcpdump to include interface info with each packet per line?

linux

1 Answers

  1. It turns out that this was essentially a duplicate that I was unable to find easily and the system didn't recommend. I thought I should give the answer here since it may not be 100% clear from the linked suggestion in the comment(s).

    First, this contains the answer more-or-less, but you have to go to his German website to get a more up-to-date script. Further a simple copy and paste can present difficulties depending on your browser, etc.

    ANSWER

    What you will want to do is to use this script (version 1.3): dump.sh

    It can be executed via: dump.sh [-i interface] [tcpdump-parameters]

    For example, I was hunting for "incorrect" flags in a sizeable XenServer installation that were due to incorrect offloading attempts by the operating system. I was able to use the command with piping thus:

    ./dump.sh -v -nn | grep -i incorrect | egrep --line-buffered -v "Interface:lo:|eth3|vif21.4|xenbr4"
    • 2