pf logging differences

[Eric]

hello all,

I had a question about how pf is logging things. Here is the setup.

Full pf logs can be viewed here: http://mikestammer.pastebin.ca/401536

I have a machine set up like this:

Internet-->Router-->bge0

and it produces pf logs that look like this:
#
tcpdump -n -e -ttt -i pflog0
#
tcpdump: WARNING: pflog0: no IPv4 address assigned
#
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
#
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 
96 bytes
#
000000 rule 0/0(match): block in on bge0: 60.224.185.113.4461 > 
72.232.135.90.80: F 1036924808:1036924808(0) ack 1855180894 win 65535
#
000346 rule 0/0(match): block in on bge0: 60.224.185.113.4462 > 
72.232.135.90.80: F 838861239:838861239(0) ack 471144513 win 65535
#
771114 rule 0/0(match): block in on bge0: 209.55.5.10.50123 > 
72.232.135.94.53:  41394 [1au][|domain]
#
99. 474278 rule 0/0(match): block in on bge0: 202.100.109.213.1332 > 
72.232.135.90.1434: UDP, length 376
#
740. 225307 rule 0/0(match): block in on bge0: 204.16.210.140.36203 > 
72.232.135.90.1026: UDP, length 421

I recently set up my home server like this:

Internet-->ng0-->sk0

ng0 is handled by mpd4

in this case, pf logging looks like this:

#
tcpdump -etttti pflog0
#
tcpdump: WARNING: pflog0: no IPv4 address assigned
#
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
#
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 
68 bytes
#
2007-03-19 08:19:35.242979 rule 1/0(match): block in on ng0: 
access.savagedata.net > 68.249.177.115: [|icmp]
#
2007-03-19 08:19:36.252372 rule 1/0(match): block in on ng0: 
access.savagedata.net > 68.249.177.115: [|icmp]
#
2007-03-19 08:19:37.262760 rule 1/0(match): block in on ng0: 
access.savagedata.net > 68.249.177.115: [|icmp]


Why is the first host producing more detailed logs? why isnt pf showing 
the port that was blocked or anything else like it does in the first 
host? Is there a way to make the ng0 interface log more or is this due 
to the netgraph hooks into pf?

Thanks a bunch

Eric