From owner-cvs-src@FreeBSD.ORG  Tue Dec 13 14:49:07 2005
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E719916A41F;
	Tue, 13 Dec 2005 14:49:07 +0000 (GMT)
	(envelope-from phk@critter.freebsd.dk)
Received: from phk.freebsd.dk (phk.freebsd.dk [130.225.244.222])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EDE4943D4C;
	Tue, 13 Dec 2005 14:49:04 +0000 (GMT)
	(envelope-from phk@critter.freebsd.dk)
Received: from critter.freebsd.dk (unknown [192.168.48.2])
	by phk.freebsd.dk (Postfix) with ESMTP id D288ABC66;
	Tue, 13 Dec 2005 14:49:00 +0000 (UTC)
To: Luigi Rizzo <rizzo@icir.org>
From: "Poul-Henning Kamp" <phk@phk.freebsd.dk>
In-Reply-To: Your message of "Tue, 13 Dec 2005 06:15:04 PST."
	<20051213061503.A10373@xorpc.icir.org> 
Date: Tue, 13 Dec 2005 15:48:59 +0100
Message-ID: <12911.1134485339@critter.freebsd.dk>
Sender: phk@critter.freebsd.dk
Cc: cvs-src@FreeBSD.org, Alexey Dokuchaev <danfe@FreeBSD.org>,
	Gleb Smirnoff <glebius@FreeBSD.org>, cvs-all@FreeBSD.org,
	src-committers@FreeBSD.org
Subject: Re: ipfw2 logs to bpf (was Re: cvs commit: src/sbin/ipfw
	ipfw2.c...) 
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Dec 2005 14:49:08 -0000

In message <20051213061503.A10373@xorpc.icir.org>, Luigi Rizzo writes:

>talking about ipfw2, a couple of years ago i posted some code for 4.x
>to let ipfw2 "log" packets to a pseudo interface called /dev/ipfw0 so
>that people in need of detailed logging could just get it from
>there through tcpdump or whatever.

Isn't it easier to use ipfwpcap(8) and a divert socket ?

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.