buildworld has resulted in tcpdump oddness

Drav Sloan holborn-pf at real-life.tm
Fri May 2 02:25:13 UTC 2008


Hiya all!

   I'm fairly new to pf and have recently set up a firewall using
it. After getting things up and running I decided to cvsup and
buildworld 7.0-RELEASE branch. However odd things started appaearing
with the output of tcpdump when the old 'tcpdump -n -e -ttt -i pflog0"
is used. Instead of the usual output I now get:

tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 68 bytes
000000 rule 6/0(match): block in on re0: [|ip]
000058 rule 6/0(match): block in on re0: [|ip]
300. 033021 rule 6/0(match): block in on re0: [|ip]
000056 rule 6/0(match): block in on re0: [|ip]
368. 212637 rule 6/0(match): block in on re0: [|ip]
000059 rule 6/0(match): block in on re0: [|ip]

As you can see the actual traffic being blocked is not "present",
so it's about as much use as Boris in a mayorial election (as
I've no idea _what_ is being blocked).

Has anyone come across this before? Have I done something
dumb with my configs that have nuked the pflog0 output?
Any ideas how I can kick this up the arse?

_Strangely_ a tcpdump of the /var/log/pflog yeilds the expected
behaviour:

# tcpdump -n -e -ttt -r /var/log/pflog
reading from file /var/log/pflog, link-type PFLOG (OpenBSD pflog file)
.
.
368. 212637 rule 6/0(match): block in on re0: 10.0.0.1.138 > 10.0.0.255.138: NBT UDP PACKET(138)
000059 rule 6/0(match): block in on re0: 10.0.0.1.138 > 10.0.0.255.138: NBT UDP PACKET(138)

I'm stumped :/

Cheers in advanced for any cl00 offered :D

Regards

Drav.


More information about the freebsd-pf mailing list