ipfw2 logs to bpf (was Re: cvs commit: src/sbin/ipfw ipfw2.c...)
rizzo at icir.org
Tue Dec 13 07:08:53 PST 2005
On Tue, Dec 13, 2005 at 03:48:59PM +0100, Poul-Henning Kamp wrote:
> In message <20051213061503.A10373 at xorpc.icir.org>, Luigi Rizzo writes:
> >talking about ipfw2, a couple of years ago i posted some code for 4.x
> >to let ipfw2 "log" packets to a pseudo interface called /dev/ipfw0 so
> >that people in need of detailed logging could just get it from
> >there through tcpdump or whatever.
> Isn't it easier to use ipfwpcap(8) and a divert socket ?
well apart that i just learned about it from this email and couldn't
find a manpage, they are similar in spirit but they don't seem to
do exactly the same thing:
- 'log' is an option that you can set on any ipfw rule, independently
from the action;
- ipfwpcap only works on divert or tee rules (i read in the code
that tee is broken but assume it can be fixed so the performance
objection for the -r option will not matter, eventually).
so i believe the /dev/ipfw trick is a bit more flexible
> Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
> phk at FreeBSD.ORG | TCP/IP since RFC 956
> FreeBSD committer | BSD since 4.3-tahoe
> Never attribute to malice what can adequately be explained by incompetence.
More information about the cvs-src