]] Marc Haber > On Thu, 13 Jul 2017 19:37:52 +0200, Tollef Fog Heen <tfh...@err.no> > wrote: > >]] Marc Haber > >> My finger memory will still type tcpdump -i eth0 before the brain can > >> intervene ten years from now. > > > >In that particular case, I'll recommend you either leaving out the -i > >switch completely or just doing `-i any`. I find it's rare I care about > >what interface traffic happens on. YMMV, of course. > > As a general paranoid type of guy, my foot nails curl up when I see a > tcpdump command line without -i. I don't know where this originates > from. Did tcpdump support the "listen on all interfaces" semantics > without -i from the beginning?
I don't think it listens on all interfaces without -i, it just listens on the first one (I think the first one with a configured address, which in the trivial case is the one you want). I don't know why it tickles your spider sense to run it without -i. -- Tollef Fog Heen UNIX is user friendly, it's just picky about who its friends are
