Watching /var/log/pflog grow

[Matthew Seaman]

cpghost wrote:
> How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
> 
> This won't work:
>   $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> because tail doesn't start at the right location.
> 
> Using a blocksize (-b) with tail may also not be right,
> because the captured packets are not the same size.
> 
> This seems to work:
>   $ tcpdump -n -s 116 -i pflog0
> but now, both tcpdump and pflogd are competing for the same
> interface pflog0.
> 
> I'm afraid that in the latter case, every packet will be
>   EITHER logged by pflogd
>   XOR    displayed by tcpdump.
> Is that so?
> 
> If yes, /var/log/pflog would be incomplete, because some packets
> would have been snatched away from pflog0 by tcpdump, before
> pflogd ever got a chance to read them out.
> 
> Is there a way to watch /var/log/pflog grow, while
> still making sure that pflogd logs EVERY packet that appears
> on the pflog0 interface? How?
> 

Running tcpdump against the pflog0 pseudo-interface no more stops
pflogd recording the traffic than running tcpdump on your network
interface blocks traffic from the net.

   tcpdump -vv -i pflog0

really is the way to go if you want to see what your firewall is
logging in real time.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey     Ramsgate
                                                  Kent, CT11 9PW

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20081104/f20638ab/signature.pgp