the current libpcap record format has no way to record this information.
you might like to play around with pcap-ng.
Darren
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
On Sun, Apr 11, 2010 at 00:43, Paul LeoNerd Evans
wrote:
> Ignoring for a moment the differences in output style, I hope it's
> immediately obvious the usefulness of being able to see a packet RX'ed
> in ppp0 which is then TX'ed on wired.
It is, yes. I would definitely use such a feature.
Rich
I often require packet tracing tools, to help debug complex
routing/NATting setups on machines with many interfaces; both physical
and virtual (due to VLANs, VPNs, PPP links, etc...). It's vital to know
exactly which interface a packet is received on or sent from, to debug
these issues.
I've had a
