Rgds, Tino

Am 02.08.2023 um 10:13 schrieb Zane C B-= H <v.velox@vvelox.net>:

=EF=BB=BFOn 2023-08-01 19:39, Mark Saad wrote:<= /span>
On Aug 1, 2023, at 7:57 PM, Zane C= B-H <v.velox@vvelox.net> wrote:
=EF=BB=BFOn 2023-08-01 18:44, Ma= rk Saad wrote:
On Aug 1, 2023, at 4:39 PM, Zane C B-H &l= t;v.velox@vvelox.net> wrote:
=EF=BB=BFSo= what is a good way to get all packets passing through that the kernel curre= ntly sees? Apparently any is not support on non-Linux systems and pflog woul= d require adding log to all rules. Similarly only logs packets that match a r= ule.
J= ust run tcpdump without the -i , iirc this will dump everything.
<= /blockquote>
Nope. This just runs it on the first interface it finds.<= /span>
- pflog - requires PF, requires adding it to all rules
- ipfw tee - requires ipfw, not bad but it requires some one al= ready be using ipfw
- deamonlogger - unmaintained... quiet= literally dead upstream
- suricata - can't tell it to for= example not log packets for TCP port 443, which for most FPC purposes just c= hew up disk space and all meaningful info will be in the suricata TLS log
Now as to the question of firing up multiple instances of tc= pdump, this means that you will have duplicate packets where bridges are inv= olved.
I= haven=E2=80=99t tried it personally but maybe with Netgraph you can make a t= ap of all of this ?
W= hat is your goal ?

Replacement= for daemonlogger given it is dead upstream and no one else has picked up de= velopment. On Linux the same can easily be accomplished via tcpdump and the p= cap rotation options and then just using removing old files based on age/dis= k usage. Unfortunately FreeBSD lacks support for '-i any'. In many ways sett= led upon tcpdump as it is not likely to just stopped be developed.
Netgraph looks semiworkable via one2many and setting= the interfaces on the many side or promisc, but this also creates the issue= of the listening interface can also transmit. That said looks like putting t= he connected ng_iface in monitor mode at creation should solve that. Been lo= oking at that on and off today trying to wrap my head around netgraph.