From owner-freebsd-pf@FreeBSD.ORG  Wed Sep 13 06:07:14 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 95B5016A416
	for <freebsd-pf@freebsd.org>; Wed, 13 Sep 2006 06:07:14 +0000 (UTC)
	(envelope-from rkramer@mweb.com)
Received: from mwbmarshal.mweb.com (mwbmarshal.mweb.com [196.2.141.6])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5A6D343D46
	for <freebsd-pf@freebsd.org>; Wed, 13 Sep 2006 06:07:12 +0000 (GMT)
	(envelope-from rkramer@mweb.com)
Received: from mwbfes2.mweb.com (Not Verified[196.2.141.74]) by
	mwbmarshal.mweb.com with NetIQ MailMarshal 6.0 Service Pack 1
	(v6, 0, 3, 28) id <B4507a00e0000>; Wed, 13 Sep 2006 08:07:10 +0200
Received: from MWBEXCH.mweb.com ([196.2.141.75]) by mwbfes2.mweb.com with
	Microsoft SMTPSVC(6.0.3790.211); Wed, 13 Sep 2006 08:07:10 +0200
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 13 Sep 2006 08:07:10 +0200
Message-ID: <39DC135F7F0571489196E0B6F5D58B4A01B27011@MWBEXCH.mweb.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: fwanalog on FreeBSD & PF
Thread-Index: AcbW+u0Z9wgoiYwYTu23Mka2zfOlLg==
From: "Rudi Kramer" <rkramer@mweb.com>
To: <freebsd-pf@freebsd.org>
X-OriginalArrivalTime: 13 Sep 2006 06:07:10.0736 (UTC)
	FILETIME=[D9970900:01C6D6FA]
Subject: fwanalog on FreeBSD & PF
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Sep 2006 06:07:14 -0000

Good Morning,

I'm busy trying to setup fwanalog on FreeBSD 6.1 using PF but I receive =
the following error message:

tcpdump: bad dump file format

<Snipet from fwanalog.out/analog.err>

C: 846592 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > =
196.2.148.63.137: UDP, length 50
C:                         *
C: 594470 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > =
196.2.148.63.137: UDP, length 50
C:                         *
C: 343338 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > =
196.2.148.63.137: UDP, length 50
C:                         *
C: 558290 rule 0/0(match): block in on fxp0: 196.2.148.12.138 > =
196.2.148.63.138: UDP, length 201
C:                         *
analog: Warning L: Large number of corrupt lines in logfile
  /root/fwanalog.out/fwanalog.all.log: turn debugging on or try =
different
  LOGFORMAT
  (For help on all errors and warnings, see docs/errors.html)
    Current logfile format:
      %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%j" %t =
%v\n


It seems like the tcpdump format used in FreebSD differs from openBSD.=20

Does anyone have a working config that I can try?
=A0=20
Thanks
Rudi