From nobody Thu Aug  3 18:31:15 2023
X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RGy9C0q6Fz4TngY
	for <freebsd-net@mlmmj.nyi.freebsd.org>; Thu,  3 Aug 2023 18:31:27 +0000 (UTC)
	(envelope-from tuexen@freebsd.org)
Received: from drew.franken.de (drew.ipv6.franken.de [IPv6:2001:638:a02:a001:20e:cff:fe4a:feaa])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "*.franken.de", Issuer "Sectigo RSA Domain Validation Secure Server CA" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4RGy9B5WyVz4qqn
	for <freebsd-net@freebsd.org>; Thu,  3 Aug 2023 18:31:26 +0000 (UTC)
	(envelope-from tuexen@freebsd.org)
Authentication-Results: mx1.freebsd.org;
	none
Received: from smtpclient.apple (unknown [IPv6:2a02:8109:1140:c3d:e80f:4253:61d8:bc92])
	(Authenticated sender: micmac)
	by mail-n.franken.de (Postfix) with ESMTPSA id CA0AA8220BFD5;
	Thu,  3 Aug 2023 20:31:15 +0200 (CEST)
Content-Type: text/plain;
	charset=utf-8
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-net
List-Help: <mailto:freebsd-net+help@freebsd.org>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Subscribe: <mailto:freebsd-net+subscribe@freebsd.org>
List-Unsubscribe: <mailto:freebsd-net+unsubscribe@freebsd.org>
Sender: owner-freebsd-net@freebsd.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
Subject: Re: Is there a FreeBSD equivalent of 'tcpdump -i any' from Linux?
From: tuexen@freebsd.org
In-Reply-To: <CANNwXrZaXgtjkKQNQYNszdsjnkW2Dxh6YvALSy=yBCyW0d5YvA@mail.gmail.com>
Date: Thu, 3 Aug 2023 20:31:15 +0200
Cc: freebsd-net@freebsd.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <75FD39FF-FA6D-46BB-900A-E7192A174C28@freebsd.org>
References: <826851ce2108b23515f81a8aca8d9b0e@vvelox.net>
 <CANNwXrZaXgtjkKQNQYNszdsjnkW2Dxh6YvALSy=yBCyW0d5YvA@mail.gmail.com>
To: Perttu Laine <plaine@gmail.com>
X-Mailer: Apple Mail (2.3731.700.6)
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00,
	T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.1
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de
X-Rspamd-Queue-Id: 4RGy9B5WyVz4qqn
X-Spamd-Bar: ----
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:680, ipnet:2001:638::/32, country:DE]

> On 3. Aug 2023, at 14:59, Perttu Laine <plaine@gmail.com> wrote:
>=20
> On Tue, Aug 1, 2023 at 11:38=E2=80=AFPM Zane C B-H =
<v.velox@vvelox.net> wrote:
>>=20
>> So what is a good way to get all packets passing through that the =
kernel
>> currently sees? Apparently any is not support on non-Linux systems =
and
>> pflog would require adding log to all rules. Similarly only logs =
packets
>> that match a rule.
>>=20
>=20
> tcpdump -i em0 & tcpdump -i em1 & tcpdump -i em2
>=20
> should work
dumpcap, the capture tool used by wireshark and thark, supports =
capturing
on multiple interfaces.

Best regards
Michael
>=20
> --=20
> Perttu Laine, Kirvesmiespalvelu Laine Ky
>=20