Which network interface?

When dealing with servers with multiple network cards (read: two to eight), the question of "Which network interface does this IP address go on?" can be rather daunting to answer. Fortunately there is a relatively easy method to answer this question. Rather than trying each IP address on each interface, I try to work smarter and let the network tell me.

I have found it both very quick and very easy to assign the 0.0.0.0/0 IP address to an interface, it doesn't matter which one, and then use TCPDump (or Wireshark) to sniff the interface to see what noise is on the wire. Frequently there will be a broadcast or an ARP that will give me a hint as to which IP subnet is on the wire of the interface that I'm sniffing. With this information at hand, I can identify which of the IP addresses I want to use would be part of the subnet, thus belongs on that interface.

Sometimes, when there is no noise on the wire, I find that I need to create some noise to find. So, to avoid this, I frequently open another terminal and start a ping for the IP address(es) that I'm interested in. Doing this will cause the router (or another system in the same subnet) for the subnet that I'm looking at to send out ARP packets.

I find this method to be more and more efficient as the number of interfaces goes up. It's not too difficult to assign an IP to one interface and try pinging the something known on the network (like a gateway) and then try a second interface if the first fails. But what happens when there are more than two interfaces? This is when the efficiency suffers. Simply put, for each additional interface, the number of possible permutations to iterate through goes up. Where as sniffing all of the interfaces at once makes it possible to know what subnet each interface is on. Thus it becomes a simple matter of matching the IP address to the interface in the subnet.