4

How to listen all interfaces on FreeBSD with tcpdump

> tcpdump -i any
tcpdump: any: No such device exists
(BIOCSETIF failed: Device not configured)

(I would like to listen ICMP)

7
  • 3
    any is a linux specific construct... Mar 17 '18 at 23:23
  • try to run without -i. Mar 18 '18 at 0:04
  • @RuiFRibeiro what is correct under FreeBSD?
    – Dims
    Mar 18 '18 at 9:40
  • @YurijGoncharuk tcpdump any icmp doesn't work
    – Dims
    Mar 18 '18 at 9:41
  • 2
    As @RuiFRibeiro already stated, "any" is a Linux only option and doesn't work anywhere else. Read the man page.
    – Rob
    Mar 18 '18 at 10:55
1

I'm looking at this on FreeBSD 11.3 and there doesn't appear to be any way to do an "any". I thought multiple -is might work, despite the manpage's silence on it, but it only takes the first one. If tcpdump gets enhanced to support multiple -is then this ought to do it (or you can prove that it doesn't on your system):

tcpdump --list-interfaces | grep Running | cut -f 1 -d ' ' | cut -f 2- -d '.' | awk '{ print "-i " $1 }' | xargs -t -Jinterfaces tcpdump interfaces host 8.8.8.8
0

From the tcpdump man page:

An interface argument of "all" or "pktap,all" can be used to capture packets from all interfaces, including loopback and tunnel interfaces.

Therefore you can simply do, for example:

tcpdump -i all tcp port 80

If you don't specify the -i flag, then a set of all interfaces are again included in a pseudo interface that by default excludes loopback and tunnel interfaces. Again from the tcpdump man page:

On Darwin systems version 13 or later, when the interface is unspecified, tcpdump will use a pseudo interface to capture packets on a set of interfaces determined by the kernel (excludes by default loopback and tunnel interfaces).

2
0

I can't vouch for how well this method would serve any particular use case, but the brute force way to do this in FreeBSD would be to run N instances of tcpdump, one for each of the N interfaces known to ifconfig. You might run them as a grouped and backgrounded command, sending their combined output to a single file. It seems inevitable that the output file will have numerous duplicated packets, such as showing a packet when it arrives on interface a and then showing it again when it departs on interface b.

But if you really have to do it that way, consider:

{
    for i in $(ifconfig -l)
    do
        ( tcpdump -i $i & )
    done
} > tcpdump.out
-2

As with anything in FreeBSD: Reading the manpage usually explains everything.

       -i interface
   --interface=interface
      Listen on interface.  If unspecified, tcpdump searches the  sys-
      tem interface list for the lowest numbered, configured up inter-
      face (excluding loopback), which may turn out to be,  for  exam-
      ple, ``eth0''.

      On  Linux  systems with 2.2 or later kernels, an interface argu-
      ment of ``any'' can be used to capture packets from  all  inter-
      faces.   Note  that  captures  on the ``any'' device will not be
      done in promiscuous mode.

      If the -D flag is supported, an interface number as  printed  by
      that flag can be used as the interface argument, if no interface
      on the system has that number as a name.

https://www.freebsd.org/cgi/man.cgi?query=tcpdump&apropos=0&sektion=0&manpath=FreeBSD+12.1-RELEASE+and+Ports&arch=default&format=html

1
  • 2
    "On Linux systems"?
    – Dims
    Sep 19 '20 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.