Trying to see pf's logs using tcpdump

[Max Laier]

On Sunday 29 August 2004 00:10, Erik U. wrote:
> On FreeBSD 5.2.1.
>
> I installed pf from the ports, configured and ran it.
> I just get this error when trying to watch pf's logs:
>
> [root at nat] ~ $ tcpdump -n -e -ttt -r /var/log/pflog
> tcpdump: unknown data link type 117

prefix this with "pf" as:
[root at nat] ~ $ pftcpdump -n -e -ttt -r /var/log/pflog

and you should be fine.

> Why can't they just put the logs in text not in some damn binary..

It's not "some damn binary" it's a pcap file and it is uses as it has *all* 
the information and not just some obscure bits that the developer though 
might be interesting. The great benefit of this is the ability to pass the 
pflog-output (more or less) unmodified to an IDS which usually needs more 
information than most of the plain-text logs will give you.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: signature
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20040829/1fee6f38/attachment.bin