I'm making an script, and I need to detect in what interface is the traffic of an IP going through. This is because in the arch, an IP address is attended only for one of four NIC's, but can be any of those four.

The manual way I did is running a tcpdump: if I see packets, then this is the interface; if not, cancel tcpdump, and do another tcpdump on another interface.

I'm running FreeBSD.

  • How about route -n?
    – jordanm
    Apr 26, 2013 at 1:51
  • route -n don't let me to know packets going on an interface, only changes of routing
    – X3MBoy
    Apr 26, 2013 at 2:05
  • IIF it is available on FreeBSD, have you tried iftop ?
    – user86969
    Apr 26, 2015 at 8:58
  • @Nasha sadly i can't try anymore because i'm not working with that company anymore. The best approach was the answer of Giles
    – X3MBoy
    Jun 21, 2015 at 17:05

3 Answers 3


Call route get.

route get | awk '$1 ~ /interface/ {print $2}'
  • This work, but i have another issue, this is not the interface i'm looking for. I'm now thinking that i'm having traffic for several interfaces. So the question is dismissed because have a tecnical error.
    – X3MBoy
    May 8, 2013 at 4:45
  • Thx for support
    – X3MBoy
    May 8, 2013 at 4:46

netstat -tau shows you the local address and port used by a program. Each interface has its own address, except cases like bonding... Is that the information you need?

If that's so, it's easy to grep and cut the output to use it in a script.

For example: netstat -taunpe | grep firefox | awk '{print $4}' | cut -d ':' -f 1 retrieves the local address used by the connections "firefox" has established.


I'm not sure about *BSDs, but on Linuxes route -n tells you (apart from other things) flags (you'd probably want to search for the line which is marked as default route) and the device name:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0   U     0      0        0 eth0       U     0      0        0 lo     U     0      0        0 eth0


$ ip route
default via dev eth0 dev eth0  proto kernel  scope link  src dev lo  scope link dev eth0  scope link

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.