Hi all

 

Assume that you have a linux bridge with two interfaces eth0 and eth1
enslaved to this bridge

What is the difference between sniffing the bridge and sniffing its
interfaces?

 

tcpdump -i br0   vs tcpdump -i eth0

 

Thanks

MiniME