On Monday 28 March 2011, Min Wang wrote: > I have a bond interface (eth0_eth1), where -d any means any > interface, so I guess the ngrep will capture the traffic both from the > eth0 and bond0. Hi Min, yes, it will capture from all (bonding) interfaces if you not specify only one. Cheers, Henning