Each bridge instance is assigned an observability node, which appears in the /dev/net/ directory and is named with the bridge name plus a trailing 0, for example, /dev/net/bridgeofsighs0.
The observability node is intended for use with the snoop command and the wireshark packet analyzer. This node operates like a standard Ethernet interface except for the transmission of packets, which are silently dropped. You cannot plumb IP on top of an observability node, and you cannot perform bind requests (DL_BIND_REQ) unless you use the passive option, which enables you only to receive packets and not to send them.
The observability node makes a single unmodified copy of every packet handled by the bridge. It is available to the user for monitoring and debugging. This behavior is similar to monitoring a port on a traditional bridge and is subject to the usual datalink provider interface (DLPI) promiscuous mode rules. You can also use the pfmod command or features in the snoop command and the wireshark packet analyzer to filter packets based on the VLAN ID.
The delivered packets, which are the packets that are sent to the observability node, represent the data received by the bridge.
To see the packets that are transmitted and received on a particular link after the bridging process is complete, run the snoop command on the individual links rather than on the bridge observability node.
You can also obtain statistics about how network packets use network resources on links by using the dlstat command. For information, see Chapter 8, Monitoring Network Traffic and Resource Usage in Managing Network Virtualization and Network Resources in Oracle Solaris 11.3.