Date: Wed, 26 Oct 2005 10:53:27 +0400 From: dawnshade <dawnshade@mail.ru> To: freebsd-stable@freebsd.org, anton@nikiforov.ru Cc: stable@freebsd.org Subject: Re: pf and short packets Message-ID: <200510261053.27853.dawnshade@mail.ru> In-Reply-To: <435E85AB.3070701@nikiforov.ru> References: <435E85AB.3070701@nikiforov.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tuesday 25 October 2005 23:21, Anton Nikiforov wrote: > štcpdump -n -e -ttt -x -i pflog0 host 127.0.0.1 > 000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 > > 127.0.0.1.643: . ack 30 win 65535 > š š š š š0x0000: š4600 002c 6605 4000 0306 11c5 7f00 0001 šF..,f.@......... > š š š š š0x0010: š7f00 0001 0100 0000 0202 0283 8129 5dab š.............)]. > š š š š š0x0020: š5db7 f2f2 5010 ffff 7dce 0000 š š š š š š]...P...}... > 000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 > > 127.0.0.1.643: . ack 30 win 65535 > š š š š š0x0000: š4600 002c d21d 4000 0306 a5ac 7f00 0001 šF..,..@......... > š š š š š0x0010: š7f00 0001 0100 0000 0202 0283 8129 5dab š.............)]. > š š š š š0x0020: š5db7 f2f2 5010 ffff 7dce 0000 š š š š š š]...P...}... > > The rule for this packet is not a "log" one, but the sign (short) is > what i cannot understand. Read 'man 1 tcpdump' about key "-s". You command must be like "tcpdump -s 1000 -n -e -ttt -x -i pflog0 host 127.0.0.1" Change value 1000 to appropriate.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510261053.27853.dawnshade>