So I managed to set up a bond interface with iproute2 after I failed to set up a bridge, because it isn't supported with the kernel 3.16.6-tinycore.
bmarkus said that you can also use bride, but now I'm thinking in the other direction, can I also use a bond to monitor the same traffic?
You can put two Ethernet interfaces to a bridge and monitor traffic with pcap than analyze with WireShark. No need for bonding.