From nobody Thu Aug 3 20:57:13 2023 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RH1PV5nH2z4Typ3 for ; Thu, 3 Aug 2023 20:57:18 +0000 (UTC) (envelope-from tuexen@freebsd.org) Received: from drew.franken.de (mail-n.franken.de [193.175.24.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Sectigo RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RH1PV3CDsz3L0K for ; Thu, 3 Aug 2023 20:57:18 +0000 (UTC) (envelope-from tuexen@freebsd.org) Authentication-Results: mx1.freebsd.org; none Received: from smtpclient.apple (ip4d15f6ca.dynamic.kabel-deutschland.de [77.21.246.202]) (Authenticated sender: micmac) by mail-n.franken.de (Postfix) with ESMTPSA id 48EEF76977D21; Thu, 3 Aug 2023 22:57:14 +0200 (CEST) Content-Type: text/plain; charset=us-ascii List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\)) Subject: Re: Is there a FreeBSD equivalent of 'tcpdump -i any' from Linux? From: tuexen@freebsd.org In-Reply-To: <196DA088-B99A-4A54-B06F-ACA0641C7559@iitbombay.org> Date: Thu, 3 Aug 2023 22:57:13 +0200 Cc: Zane C B-H , net@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <74AC6F31-A287-4F34-AA2E-E2CA0E4F7819@freebsd.org> References: <826851ce2108b23515f81a8aca8d9b0e@vvelox.net> <196DA088-B99A-4A54-B06F-ACA0641C7559@iitbombay.org> To: Bakul Shah X-Mailer: Apple Mail (2.3731.700.6) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Rspamd-Queue-Id: 4RH1PV3CDsz3L0K X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:680, ipnet:193.174.0.0/15, country:DE] > On 3. Aug 2023, at 19:18, Bakul Shah wrote: >=20 > Not quite what you asked for but I recently found = https://github.com/gcla/termshark -- it seems to be like wireshark but = for a terminal window. Like tcpdump it has the -D option that will = return a list of interfaces. If you are handy with go programming, you = may wish to consider enhancing it to listen to multiple interfaces. It = is under 1400 lines of code. May be you can use one goroutine per = interface and then each can feed packets to the display goroutine over a = go channel. [I haven't actually dug into the code, but this is how I = would go about it -- but first check that libpcap is reentrant] termshark can use dumpcap for capturing, which already supports multiple = interfaces. So it would be a matter of passing the right parameters to dumpcap. Best regards Michael >=20 >> On Aug 1, 2023, at 11:21 AM, Zane C B-H wrote: >>=20 >> So what is a good way to get all packets passing through that the = kernel currently sees? Apparently any is not support on non-Linux = systems and pflog would require adding log to all rules. Similarly only = logs packets that match a rule. >>=20 >=20 >=20