Detect which interface traffic to an IP address goes through

Question

I'm making an script, and I need to detect in what interface is the traffic of an IP going through. This is because in the arch, an IP address is attended only for one of four NIC's, but can be any of those four.

The manual way I did is running a tcpdump: if I see packets, then this is the interface; if not, cancel tcpdump, and do another tcpdump on another interface.

I'm running FreeBSD.

Answer 1

Call route get.

route get 192.0.2.42 | awk '$1 ~ /interface/ {print $2}'

Answer 2

netstat -tau shows you the local address and port used by a program. Each interface has its own address, except cases like bonding... Is that the information you need?

If that's so, it's easy to grep and cut the output to use it in a script.

For example: netstat -taunpe | grep firefox | awk '{print $4}' | cut -d ':' -f 1 retrieves the local address used by the connections "firefox" has established.

Answer 3

I'm not sure about *BSDs, but on Linuxes route -n tells you (apart from other things) flags (you'd probably want to search for the line which is marked as default route) and the device name:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.100.63.254   0.0.0.0         UG    0      0        0 eth0
10.100.0.0      0.0.0.0         255.255.192.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0

or:

$ ip route
default via 10.100.63.254 dev eth0 
10.100.0.0/18 dev eth0  proto kernel  scope link  src 10.100.12.38 
127.0.0.0/8 dev lo  scope link 
169.254.0.0/16 dev eth0  scope link