Watching /var/log/pflog grow
cpghost at cordula.ws
Tue Nov 4 21:22:05 PST 2008
On Tue, Nov 04, 2008 at 07:20:42PM +0000, Matthew Seaman wrote:
> cpghost wrote:
> > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
> > This won't work:
> > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> > because tail doesn't start at the right location.
> > Using a blocksize (-b) with tail may also not be right,
> > because the captured packets are not the same size.
> > This seems to work:
> > $ tcpdump -n -s 116 -i pflog0
> > but now, both tcpdump and pflogd are competing for the same
> > interface pflog0.
> > I'm afraid that in the latter case, every packet will be
> > EITHER logged by pflogd
> > XOR displayed by tcpdump.
> > Is that so?
> > If yes, /var/log/pflog would be incomplete, because some packets
> > would have been snatched away from pflog0 by tcpdump, before
> > pflogd ever got a chance to read them out.
> > Is there a way to watch /var/log/pflog grow, while
> > still making sure that pflogd logs EVERY packet that appears
> > on the pflog0 interface? How?
> Running tcpdump against the pflog0 pseudo-interface no more stops
> pflogd recording the traffic than running tcpdump on your network
> interface blocks traffic from the net.
Ah, okay. pflog0 therefore delivers a *copy* of the packets to all
subscribers. That's good to know!
> tcpdump -vv -i pflog0
> really is the way to go if you want to see what your firewall is
> logging in real time.
Yep, will do. Thanks for helping.
> Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
> Flat 3
> PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
> Kent, CT11 9PW
Cordula's Web. http://www.cordula.ws/
More information about the freebsd-questions