1

I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.

I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any definition of the interface identifier (eth0, eth10, br4, etc.)

Is there a way to instruct tcpdump to include interface info with each packet per line?

ylluminate
  • 1,001
  • 2
  • 15
  • 29
  • 1
    I think this might answer your question, https://serverfault.com/questions/224698/how-to-display-interface-in-tcpdump-output-flow – Desultory Mar 01 '18 at 19:16
  • Thanks guys. I've giving a little more concise answer below based on that @Desultory. – ylluminate Mar 01 '18 at 21:09

1 Answers1

2

It turns out that this was essentially a duplicate that I was unable to find easily and the system didn't recommend. I thought I should give the answer here since it may not be 100% clear from the linked suggestion in the comment(s).

First, this contains the answer more-or-less, but you have to go to his German website to get a more up-to-date script. Further a simple copy and paste can present difficulties depending on your browser, etc.

ANSWER

What you will want to do is to use this script (version 1.3): dump.sh

It can be executed via: dump.sh [-i interface] [tcpdump-parameters]

For example, I was hunting for "incorrect" flags in a sizeable XenServer installation that were due to incorrect offloading attempts by the operating system. I was able to use the command with piping thus:

./dump.sh -v -nn | grep -i incorrect | egrep --line-buffered -v "Interface:lo:|eth3|vif21.4|xenbr4"
ylluminate
  • 1,001
  • 2
  • 15
  • 29