Tshark/wireshark on an ephemeral interface

Question

Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently.

What we need is a way to capture packets using tshark for all ppp interfaces even though they may go up or down intermittently.

Any ideas or solutions will be greatly appreciated.

score 2 · Accepted Answer · answered Apr 01 '14 at 10:05

2

You can capture packets from the any interface. That will give you all packets regardless of which interface they were sent or received on. Then you can apply a capture filter to ignore those packets, you are not interested in. For example ! (host 127.0.0.1 || host ::1) would ignore all packets on the lo interface.

answered Apr 01 '14 at 10:05

kasperd

30,455
17
76
124

Will this dynamically include new interfaces? – Climax Apr 01 '14 at 12:04

Tshark/wireshark on an ephemeral interface

1 Answers1