ipfw2 logs to bpf (was Re: cvs commit: src/sbin/ipfw ipfw2.c...)
rizzo at icir.org
Tue Dec 13 09:33:02 PST 2005
On Tue, Dec 13, 2005 at 05:59:07PM +0100, Max Laier wrote:
> On Tuesday 13 December 2005 16:08, Ceri Davies wrote:
> > On Tue, Dec 13, 2005 at 06:15:04AM -0800, Luigi Rizzo wrote:
> > > talking about ipfw2, a couple of years ago i posted some code for 4.x
> > > to let ipfw2 "log" packets to a pseudo interface called /dev/ipfw0 so
> > > that people in need of detailed logging could just get it from
> > > there through tcpdump or whatever.
> > I don't actually use pf, but there is a pflog interface which I believe
> > does a similar thing. It would be good to integrate the two somehow.
> Indeed. pflog(4) has the additional edge that it prepends a header that
> indicates the reason for logging this packet - i.e. rule number, action,
ok it certainly looks like something that is fully usable for ipfw
as well, and i think that as a first step the patch i submitted can be
trivially simplified to use "pflog".
On a related topic, what is the point, in net/bpf.c, of duplicating
the body of bpf_mtap2 into bpf_mtap when the latter could be
implemented in terms of the former, with only a very
minor change (essentially checking for NULL data and
prepending mb or not accordingly) ?
More information about the cvs-src