Unix/Linux Go Back    

NetBSD 6.1.5 - man page for pflog (netbsd section 4)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)

PFLOG(4)			   BSD Kernel Interfaces Manual 			 PFLOG(4)

     pflog -- packet filter logging interface

     pseudo-device pflog

     The pflog interface is a pseudo-device which makes visible all packets logged by the packet
     filter, pf(4).  Logged packets can easily be monitored in real time by invoking tcpdump(8)
     on the pflog interface, or stored to disk using pflogd(8).

     The pflog0 interface is created automatically at boot if both pf(4) and pflogd(8) are
     enabled; further instances can be created using ifconfig(8).

     Each packet retrieved on this interface has a header associated with it of length
     PFLOG_HDRLEN.  This header documents the address family, interface name, rule number, rea-
     son, action, and direction of the packet that was logged.	This structure, defined in
     <net/if_pflog.h> looks like

	   struct pfloghdr {
		   u_int8_t	   length;
		   sa_family_t	   af;
		   u_int8_t	   action;
		   u_int8_t	   reason;
		   char 	   ifname[IFNAMSIZ];
		   char 	   ruleset[PF_RULESET_NAME_SIZE];
		   u_int32_t	   rulenr;
		   u_int32_t	   subrulenr;
		   uid_t	   uid;
		   pid_t	   pid;
		   uid_t	   rule_uid;
		   pid_t	   rule_pid;
		   u_int8_t	   dir;
		   u_int8_t	   pad[3];

     Create a pflog interface and monitor all packets logged on it:

	   # ifconfig pflog1 up
	   # tcpdump -n -e -ttt -i pflog1

     inet(4), inet6(4), netintro(4), pf(4), ifconfig(8), pflogd(8), tcpdump(8)

     The pflog device first appeared in OpenBSD 3.0.

BSD					   May 31, 2007 				      BSD
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums

All times are GMT -4. The time now is 06:07 AM.