From owner-freebsd-pf@FreeBSD.ORG  Sat Aug 21 01:03:15 2010
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7381C106566B
	for <freebsd-pf@freebsd.org>; Sat, 21 Aug 2010 01:03:15 +0000 (UTC)
	(envelope-from gpalmer@freebsd.org)
Received: from noop.in-addr.com (mail.in-addr.com [IPv6:2001:470:8:162::1])
	by mx1.freebsd.org (Postfix) with ESMTP id 4CD738FC08
	for <freebsd-pf@freebsd.org>; Sat, 21 Aug 2010 01:03:15 +0000 (UTC)
Received: from gjp by noop.in-addr.com with local (Exim 4.54 (FreeBSD))
	id 1OmcUL-000GCH-Ej; Fri, 20 Aug 2010 21:03:13 -0400
Date: Fri, 20 Aug 2010 21:03:13 -0400
From: Gary Palmer <gpalmer@freebsd.org>
To: Free BSD <freebsd@vfemail.net>
Message-ID: <20100821010313.GC86366@in-addr.com>
References: <4C6EF6A3.1060204@vfemail.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4C6EF6A3.1060204@vfemail.net>
Cc: freebsd-pf@freebsd.org
Subject: Re: how to use pflog with lagg device
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Aug 2010 01:03:15 -0000

On Fri, Aug 20, 2010 at 10:41:55PM +0100, Free BSD wrote:
> However, if I try to view the log, it says
> 
> tcpdump -n -e ttt -i pflog0
> tcpdump: WARNING: em0: no IPv4 address assigned
> tcpdump: syntax error

Your command syntax is incorrect.  You are missing a '-' from the 'ttt'
option.  Try:

tcpdump -n -e -ttt -i pflog0

The pflog command I personally use is:

tcpdump -s 0 -i pflog0 -n -tttte

Regards,

Gary