From nobody Tue Aug  1 18:21:43 2023
X-Original-To: net@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RFk3Q5bKwz4pj0F
	for <net@mlmmj.nyi.freebsd.org>; Tue,  1 Aug 2023 18:21:56 +0000 (UTC)
	(envelope-from v.velox@vvelox.net)
Received: from vulpes.vvelox.net (vulpes.vvelox.net [98.102.84.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 4RFk364CRzz4VrS
	for <net@freebsd.org>; Tue,  1 Aug 2023 18:21:54 +0000 (UTC)
	(envelope-from v.velox@vvelox.net)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	spf=pass (mx1.freebsd.org: domain of v.velox@vvelox.net designates 98.102.84.2 as permitted sender) smtp.mailfrom=v.velox@vvelox.net;
	dmarc=none
Received: from vvelox.net (localhost [127.0.0.1])
	(Authenticated sender: kitsune)
	by vulpes.vvelox.net (Postfix) with ESMTPA id C1510AC6CA5
	for <net@freebsd.org>; Tue,  1 Aug 2023 13:21:43 -0500 (CDT)
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-net
List-Help: <mailto:freebsd-net+help@freebsd.org>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Subscribe: <mailto:freebsd-net+subscribe@freebsd.org>
List-Unsubscribe: <mailto:freebsd-net+unsubscribe@freebsd.org>
Sender: owner-freebsd-net@freebsd.org
MIME-Version: 1.0
Date: Tue, 01 Aug 2023 13:21:43 -0500
From: Zane C B-H <v.velox@vvelox.net>
To: net@freebsd.org
Subject: Is there a FreeBSD equivalent of 'tcpdump -i any' from Linux?
Message-ID: <826851ce2108b23515f81a8aca8d9b0e@vvelox.net>
X-Sender: v.velox@vvelox.net
Organization: v.velox@vvelox.net
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [-2.12 / 15.00];
	SUBJECT_ENDS_QUESTION(1.00)[];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.92)[-0.923];
	R_SPF_ALLOW(-0.20)[+ip4:98.102.84.2/32];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_NO_TLS_LAST(0.10)[];
	MIME_TRACE(0.00)[0:+];
	ASN(0.00)[asn:10796, ipnet:98.102.80.0/20, country:US];
	MLMMJ_DEST(0.00)[net@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	R_DKIM_NA(0.00)[];
	DMARC_NA(0.00)[vvelox.net];
	HAS_ORG_HEADER(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[net@freebsd.org];
	RCPT_COUNT_ONE(0.00)[1];
	MID_RHS_MATCH_FROM(0.00)[]
X-Rspamd-Queue-Id: 4RFk364CRzz4VrS
X-Spamd-Bar: --

So what is a good way to get all packets passing through that the kernel 
currently sees? Apparently any is not support on non-Linux systems and 
pflog would require adding log to all rules. Similarly only logs packets 
that match a rule.