Re: How to use "pcap" on a router ???

[Guy Harris <guy () alum mit edu>]

kashif wrote:

> I have configured my PC running RedHat Linux 9.0 into a router by
> turning on the ip_forwarding facility of it. It got TWO LAN cards...and if i
> run two instances of *pcap* one for each LAN card for capturing
> packets, it works fine....But i intend writing an application wherein
> i need the
> information captured by both the instances..I mean if i want to
> capture packets from both the LAN cards simultaneously in one
> application..

As this is Linux, the "any" device is supported by libpcap; it leaves 
the PF_PACKET socket unbound, so that packets from all interfaces are 
delivered to it.  You don't get raw packet headers when capturing with 
the "any" device, but you might not need that.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.