Re: capturing on both interfaces simultaneously

[rixed () happyleptic org]

If you are willing to do this on a regular basis, the junkie sniffer [1]
(build atop libpcap) can do this with a somewhat complex command line
such as:

junkie -p /usr/local/lib/junkie/writer.so -i phy0 -i phy1 --file capture.pcap

If you are not doing this regularly, and considering you are doing this
from a constrained arch, installing junkie and its dependencies
certainly does not worth the trouble. mergecap is great.


[1]: http://github.com/securactive/junkie/

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.