pf logging differences

[Max Laier]

On Monday 19 March 2007 14:35, Eric wrote:
> hello all,
>
> I had a question about how pf is logging things. Here is the setup.
>
> Full pf logs can be viewed here: http://mikestammer.pastebin.ca/401536
>
> I have a machine set up like this:
>
> Internet-->Router-->bge0
>
> and it produces pf logs that look like this:
> #
> tcpdump -n -e -ttt -i pflog0
> #
> tcpdump: WARNING: pflog0: no IPv4 address assigned
> #
> tcpdump: verbose output suppressed, use -v or -vv for full protocol
> decode #
> listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size
> 96 bytes
> #
> 000000 rule 0/0(match): block in on bge0: 60.224.185.113.4461 >
> 72.232.135.90.80: F 1036924808:1036924808(0) ack 1855180894 win 65535
> #
> 000346 rule 0/0(match): block in on bge0: 60.224.185.113.4462 >
> 72.232.135.90.80: F 838861239:838861239(0) ack 471144513 win 65535
> #
> 771114 rule 0/0(match): block in on bge0: 209.55.5.10.50123 >
> 72.232.135.94.53:  41394 [1au][|domain]
> #
> 99. 474278 rule 0/0(match): block in on bge0: 202.100.109.213.1332 >
> 72.232.135.90.1434: UDP, length 376
> #
> 740. 225307 rule 0/0(match): block in on bge0: 204.16.210.140.36203 >
> 72.232.135.90.1026: UDP, length 421
>
> I recently set up my home server like this:
>
> Internet-->ng0-->sk0
>
> ng0 is handled by mpd4
>
> in this case, pf logging looks like this:
>
> #
> tcpdump -etttti pflog0
> #
> tcpdump: WARNING: pflog0: no IPv4 address assigned
> #
> tcpdump: verbose output suppressed, use -v or -vv for full protocol
> decode #
> listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size
> 68 bytes
> #
> 2007-03-19 08:19:35.242979 rule 1/0(match): block in on ng0:
> access.savagedata.net > 68.249.177.115: [|icmp]
> #
> 2007-03-19 08:19:36.252372 rule 1/0(match): block in on ng0:
> access.savagedata.net > 68.249.177.115: [|icmp]
> #
> 2007-03-19 08:19:37.262760 rule 1/0(match): block in on ng0:
> access.savagedata.net > 68.249.177.115: [|icmp]
>
>
> Why is the first host producing more detailed logs? why isnt pf showing
> the port that was blocked or anything else like it does in the first
> host? Is there a way to make the ng0 interface log more or is this due
> to the netgraph hooks into pf?

Just specify a larger snaplen.  "tcpdump -s 0" to catch the whole packet.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20070319/49e8fc0f/attachment.pgp