When you capture from a switch, you need just one network interface because it is receiving bidirectional traffic. A tap usually sends unidirectional traffic (inbound and outbound) using two network cables.

For a tap, you must configure two network interfaces, one for each cable. In both cases, you configure the network interface the same way. A listening interface does not need an IP address because it only receives packets from a switch or tap. It is never used to send out packets on the wire.

This example configures network interface eth2 for capturing packets from a switch or tap.

File /etc/sysconfig/network-scripts/ifcfg-eth2 contains only the following lines:

DEVICE=eth2
ONBOOT=yes