If you are willing to do this on a regular basis, the junkie sniffer [1] (build atop libpcap) can do this with a somewhat complex command line such as:
junkie -p /usr/local/lib/junkie/writer.so -i phy0 -i phy1 --file capture.pcap If you are not doing this regularly, and considering you are doing this from a constrained arch, installing junkie and its dependencies certainly does not worth the trouble. mergecap is great. [1]: http://github.com/securactive/junkie/ - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
