Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm making an script, and I need to detect in what interface is the traffic of an IP going through. This is because in the arch, an IP address is attended only for one of four NIC's, but can be any of those four.

The manual way I did is running a tcpdump: if I see packets, then this is the interface; if not, cancel tcpdump, and do another tcpdump on another interface.

I'm running FreeBSD.

share|improve this question
How about route -n? – jordanm Apr 26 '13 at 1:51
route -n don't let me to know packets going on an interface, only changes of routing – X3MBoy Apr 26 '13 at 2:05
IIF it is available on FreeBSD, have you tried iftop ? – Nasha Apr 26 '15 at 8:58
@Nasha sadly i can't try anymore because i'm not working with that company anymore. The best approach was the answer of Giles – X3MBoy Jun 21 '15 at 17:05

Call route get.

route get | awk '$1 ~ /interface/ {print $2}'
share|improve this answer
This work, but i have another issue, this is not the interface i'm looking for. I'm now thinking that i'm having traffic for several interfaces. So the question is dismissed because have a tecnical error. – X3MBoy May 8 '13 at 4:45
Thx for support – X3MBoy May 8 '13 at 4:46

netstat -tau shows you the local address and port used by a program. Each interface has its own address, except cases like bonding... Is that the information you need?

If that's so, it's easy to grep and cut the output to use it in a script.

For example: netstat -taunpe | grep firefox | awk '{print $4}' | cut -d ':' -f 1 retrieves the local address used by the connections "firefox" has established.

share|improve this answer

I'm not sure about *BSDs, but on Linuxes route -n tells you (apart from other things) flags (you'd probably want to search for the line which is marked as default route) and the device name:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0   U     0      0        0 eth0       U     0      0        0 lo     U     0      0        0 eth0


$ ip route
default via dev eth0 dev eth0  proto kernel  scope link  src dev lo  scope link dev eth0  scope link
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.