Switch-firewall-traffic-capture

I agree; I was not quite precise enough with my words.
It makes more sense to me that a NIC with an IP address would forward data to that address to the OS than forward those frames over a bridge the NIC is in, even if a NIC knows it is a member of a bridge.

I think I need to do some testing.
I have ordered a couple of devices ultimately destined for more demanding jobs, so they are more than capable and will allow me to establish the best way to do this and how good the hardware needs to be.
Thanks everyone for all the help, you are a knowledgeable lot.
Thanks in particular to Jeff, who even tested a suitable device for me.
I may be a while doing this as the hardware won't arrive for a while and there are many possible combinations of multiple technologies I have not used before.
I like learning new stuff, so I am sure this will be interesting.

In Linux, the bridge itself gets an ip address, but the individual links don't. Any packet destined to the ip address of the bridge goes to the kernel, it doesn't get forwarded across the bridge.

Interesting, I will have to try that.
By need I have only created bridges on Windows devices so far. There I think it is normal to only to apply an IP address to one of the interfaces, although I bet somebody will have found a use case to do otherwise. I think I did try an address on a bridge but I don't think it worked, I am not sure because its been a while and because but I know I ended up using an IP address on only one interface. I was on client site, so I did not have time to try every possible arrangement.
In a specific example I do remember well on a Windows laptop using a USB to Ethernet adapter, I bridged the Ethernet interface to the laptops Wi-Fi interface and tethered that to the hotspot on my mobile phone. It worked to provide a temporary Internet connection to my laptop and a Linux device connected to the Ethernet interface. The Ethernet interface could be given a static IP address, although this is not without problems, or pick up its address from the mobile phone via DHCP. In my case I was using Android, what version I don't remember, but it used a specific subnet that could not be changed. Obviously the Linux device needed to be in the same subnet with its own IP address. Anyway, the point was for that arrangement to work I had to have an IP address on the Ethernet interface.
On wireless links I have used they certainly seem to have an IP address on the Ethernet interface, although I never tested if it was actually on the bridge and just appeared to be on the Interface. Will check next time.