From owner-freebsd-net@FreeBSD.ORG  Wed Dec  5 00:32:52 2007
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 771AB16A419
	for <freebsd-net@freebsd.org>; Wed,  5 Dec 2007 00:32:52 +0000 (UTC)
	(envelope-from thompsa@FreeBSD.org)
Received: from heff.fud.org.nz (203-109-251-39.static.bliink.ihug.co.nz
	[203.109.251.39])
	by mx1.freebsd.org (Postfix) with ESMTP id 2932F13C447
	for <freebsd-net@freebsd.org>; Wed,  5 Dec 2007 00:32:47 +0000 (UTC)
	(envelope-from thompsa@FreeBSD.org)
Received: by heff.fud.org.nz (Postfix, from userid 1001)
	id 91158721D; Wed,  5 Dec 2007 13:32:45 +1300 (NZDT)
Date: Wed, 5 Dec 2007 13:32:45 +1300
From: Andrew Thompson <thompsa@FreeBSD.org>
To: Peter Losher <Peter_Losher@isc.org>
Message-ID: <20071205003245.GA48034@heff.fud.org.nz>
References: <4755EFDD.8070609@isc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4755EFDD.8070609@isc.org>
User-Agent: Mutt/1.5.16 (2007-06-09)
Cc: freebsd-net@freebsd.org
Subject: Re: Aggregating many ports into one for tcpdump server.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Dec 2007 00:32:52 -0000

On Tue, Dec 04, 2007 at 04:25:01PM -0800, Peter Losher wrote:
> I am currently working on a tcpdump collector where we have multiple
> feeds coming in (via bge{0-8}).  Since tcpdump can only poll one
> interface per process, I was hoping to aggregate the traffic onto one
> pseudo-interface for tcpdump to hold onto and to poll.
> 
> Looking thru the archives, it seems ng_one2many (in this case
> 'many2one') is what I am looking for.  Am I barking the right tree here?

You can use if_bridge(4) or lagg(4) for this purpose. lagg may be the
easier one to use, add all the ports to the lagg interface and set the
proto to 'loadbalance'. An example for using the bridge is in the
bridging section of the handbook.


Andrew