My home router has 2 internal interfaces on different subnets, and one external interface plugged into the comcast modem. I'd like to duplicate every packet that enters each interface out to a single virtual interface, at which I can direct Zeek. I think this should help me get full introspection of network traffic without duplicate logs like I'd get if I had Zeek monitor each interface separately.
While this works to duplicate traffic to "dummy0":
nft add table netdev filter
nft add chain netdev filter ingress { \
type filter hook ingress device eth0 priority 0\; }
nft add rule netdev filter ingress dup to dummy0
I cannot seem to extend it to also hook to additional ethernet devices. I find the nftables documentation to be extremely sparse on this sort of thing, so recommendations are appreciated.