I've created a bridged network Mac OS X 10.8.5 using ifconfig and TUNTAP for OS X to bridge my wireless connection, en0, with a virtual interface, tap0, which I can use for guest VMs:
$ sudo sysctl -w net.inet.ip.forwarding=1
$ sudo sysctl -w net.link.ether.inet.proxyall=1
$ sudo sysctl -w net.inet.ip.fw.enable=1
$ sudo ifconfig bridge0 create
$ sudo ifconfig bridge0 addm en0 addm tap0
$ sudo ifconfig bridge0 up
$ ifconfig
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 28:cf:xx:xx:xx:xx
inet6 xxxx::xxxx:xxxx:xxxx:xxxx%en0 prefixlen 64 scopeid 0x4
inet 192.168.100.64 netmask 0xffffff00 broadcast 192.168.100.1
media: autoselect
status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether ac:de:xx:xx:xx:xx
Configuration:
priority 0 hellotime 0 fwddelay 0 maxage 0
ipfilter disabled flags 0x2
member: en0 flags=3<LEARNING,DISCOVER>
port 4 priority 0 path cost 0
member: tap0 flags=3<LEARNING,DISCOVER>
port 8 priority 0 path cost 0
tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether ca:3d:xx:xx:xx:xx
open (pid 88244)
However, if I tcpdump -i tap0, I only see broadcast traffic. Shouldn't I see a mirror of everything on en0? (192.168.100.33, the host doing the broadcasting, is another unrelate, noisy server on my LAN.)
(I asked a similar question here and will probably close it.)