pf logging differences

[Eric]

Max Laier wrote:
> On Monday 19 March 2007 14:35, Eric wrote:
>>
>> Why is the first host producing more detailed logs? why isnt pf showing
>> the port that was blocked or anything else like it does in the first
>> host? Is there a way to make the ng0 interface log more or is this due
>> to the netgraph hooks into pf?
> 
> Just specify a larger snaplen.  "tcpdump -s 0" to catch the whole packet.
> 

THANK YOU! this works great.

Eric