Re: bond or bridge sniffing

[Matt Zagrabelny]

On Tue, 2008-12-02 at 18:57 +0200, Omer Faruk Sen wrote:
> Hi,
> 
> I have a question about linux kernel. I want to have a setup. This
> setup will have 3 interfaces (eth1,eth2,eth3) i will send traffic to
> these individual interfaces but I want to see it on just one interface
> (traffic aggregation) . I have used bond0 and br0 but when I send
> traffic to eth2 I can't see it on br0 or bond0. How can I achieve this
> on linux kernel? I can do that on FreeBSD but I must do that on Linux
> 
> Test setup:
> 
> br0 -----> eth1,eth2,eth3  or
> 
> bond0 ----> eth1,eth2,eth3 (used mode 0 and mode 3)
> 
> If I send traffic on eth2 I CANT sniff it on br0 or bond0 but If I
> sent traffic (via tcpreplay) to bond0/br0 I can sniff it on ethX.. Is
> there a facility to achieve that on Linux? I can sniff interfaces
> individually but this case is not ok for me..

Does this work for you?

tcpdump -i any

-- 
Matt Zagrabelny - mzagrabe@xxxxxxxxx - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

Attachment: signature.asc
Description: This is a digitally signed message part