Date: Sun, 29 Aug 2004 03:14:38 +0200 From: Max Laier <max@love2party.net> To: freebsd-current@freebsd.org, erik.u@dnainternet.net Subject: Re: Trying to see pf's logs using tcpdump Message-ID: <200408290314.52675.max@love2party.net> In-Reply-To: <413102D4.60804@dnainternet.net> References: <413102D4.60804@dnainternet.net>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On Sunday 29 August 2004 00:10, Erik U. wrote: > On FreeBSD 5.2.1. > > I installed pf from the ports, configured and ran it. > I just get this error when trying to watch pf's logs: > > [root@nat] ~ $ tcpdump -n -e -ttt -r /var/log/pflog > tcpdump: unknown data link type 117 prefix this with "pf" as: [root@nat] ~ $ pftcpdump -n -e -ttt -r /var/log/pflog and you should be fine. > Why can't they just put the logs in text not in some damn binary.. It's not "some damn binary" it's a pcap file and it is uses as it has *all* the information and not just some obscure bits that the developer though might be interesting. The great benefit of this is the ability to pass the pflog-output (more or less) unmodified to an IDS which usually needs more information than most of the plain-text logs will give you. -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQBBMS4MXyyEoT62BG0RAqVAAJ4qwOZSlRsFRKcPztSX3MON5pA0tgCfRWQf mDhSP/bn3cUjP7ZDR0miHoI= =Hnhe -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200408290314.52675.max>