Capture network traffic simultaneously on three interfaces

Question

I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full conversation. Since external connections are balanced between the two WAN interfaces, I wonder if is it possible to capture simultaneously on all interfaces.

I have used tcpdump previously but it only admits one interface at a time. I can launch 3 parallel processes to capture on all interfaces but then I end up with 3 different capture files.

What is the right way of doing this ?

Solution

If you use wireshark/tshark, there is a pseudo-interface named 'any' which takes all the interfaces. tshark -i any Wireshark is available on all plateforms

Edit : The any interface depends of libpcap : tcpdump have it ! tcpdump -i any

Comments

[drcelus]

Added the info - Centos 5.

[BatchyX]

you could use mergecap to merge your 3 pcap files.

[pt1]

According to github.com/the-tcpdump-group/tcpdump/issues/… the 'any' interface doesn't support promiscuous mode. (The answer was written for tcpdump but I guess it applies for tshark too.)