Aggregating many ports into one for tcpdump server. (also
sampling before libpcap)
thompsa at FreeBSD.org
Sat Dec 8 02:41:12 PST 2007
On Sat, Dec 08, 2007 at 10:35:11AM +0000, Peter Wood wrote:
> >>> Looking thru the archives, it seems ng_one2many (in this case
> >>> 'many2one') is what I am looking for. Am I barking the right tree
> Strangely enough this is the exact situation I was looking into on Friday
> for two mirror ports from our border routers via aggregation switches.
> I had seen the netgraph solution however I had initially ignored if_bridge
> as I don't want the packets to be sent to the opposing devices.
Thats why you combine if_bridge with monitor mode, any incoming packets
are discarded after bpf processing so they are never sent to opposing
More information about the freebsd-net