From nobody Wed Aug 2 03:49:32 2023 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RFyfK6RJzz4qB8L for ; Wed, 2 Aug 2023 03:49:39 +0000 (UTC) (envelope-from v.velox@vvelox.net) Received: from vulpes.vvelox.net (vulpes.vvelox.net [98.102.84.2]) by mx1.freebsd.org (Postfix) with ESMTP id 4RFyf80lc9z453v for ; Wed, 2 Aug 2023 03:49:36 +0000 (UTC) (envelope-from v.velox@vvelox.net) Authentication-Results: mx1.freebsd.org; dkim=none; spf=pass (mx1.freebsd.org: domain of v.velox@vvelox.net designates 98.102.84.2 as permitted sender) smtp.mailfrom=v.velox@vvelox.net; dmarc=none Received: from vvelox.net (localhost [127.0.0.1]) (Authenticated sender: kitsune) by vulpes.vvelox.net (Postfix) with ESMTPA id CE76BAC6CA5; Tue, 1 Aug 2023 22:49:32 -0500 (CDT) List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Date: Tue, 01 Aug 2023 22:49:32 -0500 From: Zane C B-H To: Mark Saad Cc: net@freebsd.org Subject: Re: Is there a FreeBSD equivalent of 'tcpdump -i any' from Linux? In-Reply-To: References: Message-ID: <3376670f5c14ac160e75420a2c168481@vvelox.net> X-Sender: v.velox@vvelox.net Organization: v.velox@vvelox.net Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Spamd-Result: default: False [-2.20 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.997]; R_SPF_ALLOW(-0.20)[+ip4:98.102.84.2/32]; MIME_GOOD(-0.10)[text/plain]; RCVD_NO_TLS_LAST(0.10)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; ASN(0.00)[asn:10796, ipnet:98.102.80.0/20, country:US]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; MLMMJ_DEST(0.00)[net@freebsd.org]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; TO_DN_SOME(0.00)[]; HAS_ORG_HEADER(0.00)[]; DMARC_NA(0.00)[vvelox.net]; RCVD_COUNT_TWO(0.00)[2] X-Rspamd-Queue-Id: 4RFyf80lc9z453v X-Spamd-Bar: -- On 2023-08-01 19:39, Mark Saad wrote: > On Aug 1, 2023, at 7:57 PM, Zane C B-H wrote: >> >> On 2023-08-01 18:44, Mark Saad wrote: >>>>> On Aug 1, 2023, at 4:39 PM, Zane C B-H wrote: >>>> So what is a good way to get all packets passing through that the >>>> kernel currently sees? Apparently any is not support on non-Linux >>>> systems and pflog would require adding log to all rules. Similarly >>>> only logs packets that match a rule. >>> Just run tcpdump without the -i , iirc this will dump everything. >> >> Nope. This just runs it on the first interface it finds. >> >> - pflog - requires PF, requires adding it to all rules >> - ipfw tee - requires ipfw, not bad but it requires some one already >> be using ipfw >> - deamonlogger - unmaintained... quiet literally dead upstream >> - suricata - can't tell it to for example not log packets for TCP port >> 443, which for most FPC purposes just chew up disk space and all >> meaningful info will be in the suricata TLS log >> >> Now as to the question of firing up multiple instances of tcpdump, >> this means that you will have duplicate packets where bridges are >> involved. > > I haven’t tried it personally but maybe with Netgraph you can make a > tap of all of this ? > > What is your goal ? Replacement for daemonlogger given it is dead upstream and no one else has picked up development. On Linux the same can easily be accomplished via tcpdump and the pcap rotation options and then just using removing old files based on age/disk usage. Unfortunately FreeBSD lacks support for '-i any'. In many ways settled upon tcpdump as it is not likely to just stopped be developed. Netgraph looks semiworkable via one2many and setting the interfaces on the many side or promisc, but this also creates the issue of the listening interface can also transmit. That said looks like putting the connected ng_iface in monitor mode at creation should solve that. Been looking at that on and off today trying to wrap my head around netgraph.