From owner-freebsd-pf@FreeBSD.ORG  Mon Mar 17 14:50:40 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id EA34D1065678
	for <freebsd-pf@freebsd.org>; Mon, 17 Mar 2008 14:50:40 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: from mx01.sc1.parodius.com (mx01.sc1.parodius.com [72.20.106.3])
	by mx1.freebsd.org (Postfix) with ESMTP id D8B468FC36
	for <freebsd-pf@freebsd.org>; Mon, 17 Mar 2008 14:50:40 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: by mx01.sc1.parodius.com (Postfix, from userid 1000)
	id A3EAC1CC060; Mon, 17 Mar 2008 07:50:40 -0700 (PDT)
Date: Mon, 17 Mar 2008 07:50:40 -0700
From: Jeremy Chadwick <koitsu@freebsd.org>
To: "Stephan F. Yaraghchi" <stephan@yaraghchi.org>
Message-ID: <20080317145040.GA48737@eos.sc1.parodius.com>
References: <25f52a3d0803170650j72beaeev51105ed0713f7867@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <25f52a3d0803170650j72beaeev51105ed0713f7867@mail.gmail.com>
User-Agent: Mutt/1.5.17 (2007-11-01)
Cc: freebsd-pf@freebsd.org
Subject: Re: watching the log in real time
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Mar 2008 14:50:41 -0000

On Mon, Mar 17, 2008 at 02:50:18PM +0100, Stephan F. Yaraghchi wrote:
> When I issue 'tcpdump -netttt -i pflog0' to watch the log in real time
> I'm getting pretty brief output like:
> 
> 2008-03-16 11:46:45.527125 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:45.590116 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:45.652107 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:45.715098 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:45.777087 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:47.249281 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:50.011245 rule 0/0(match): block in on fxp1: [|ip]
> 2008-03-16 11:46:52.761126 rule 0/0(match): block in on fxp1: [|ip]

Choose a larger snaplen size for tcpdump to use, e.g. tcpdump -s 1024.
Don't pick something absurdly large.

There is a discussion as to whether or not tcpdump on FreeBSD should
default to using a larger snaplen size (128 would be good).

-- 
| Jeremy Chadwick                                    jdc at parodius.com |
| Parodius Networking                           http://www.parodius.com/ |
| UNIX Systems Administrator                      Mountain View, CA, USA |
| Making life hard for others since 1977.                  PGP: 4BD6C0CB |