Date: Tue, 04 Nov 2008 19:20:42 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: cpghost <cpghost@cordula.ws> Cc: freebsd-questions@freebsd.org Subject: Re: Watching /var/log/pflog grow Message-ID: <4910A08A.6050204@infracaninophile.co.uk> In-Reply-To: <20081104191354.GA1819@phenom.cordula.ws> References: <20081104191354.GA1819@phenom.cordula.ws>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigD785781B1BF03AF468BB6783
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
cpghost wrote:
> How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
>=20
> This won't work:
> $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> because tail doesn't start at the right location.
>=20
> Using a blocksize (-b) with tail may also not be right,
> because the captured packets are not the same size.
>=20
> This seems to work:
> $ tcpdump -n -s 116 -i pflog0
> but now, both tcpdump and pflogd are competing for the same
> interface pflog0.
>=20
> I'm afraid that in the latter case, every packet will be
> EITHER logged by pflogd
> XOR displayed by tcpdump.
> Is that so?
>=20
> If yes, /var/log/pflog would be incomplete, because some packets
> would have been snatched away from pflog0 by tcpdump, before
> pflogd ever got a chance to read them out.
>=20
> Is there a way to watch /var/log/pflog grow, while
> still making sure that pflogd logs EVERY packet that appears
> on the pflog0 interface? How?
>=20
Running tcpdump against the pflog0 pseudo-interface no more stops
pflogd recording the traffic than running tcpdump on your network
interface blocks traffic from the net.
tcpdump -vv -i pflog0
really is the way to go if you want to see what your firewall is
logging in real time.
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enigD785781B1BF03AF468BB6783
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAkkQoJAACgkQ8Mjk52CukIyFkQCfUvXTAiCFLA0zNPKJwCplEI0u
f0cAni1mC+JL58T6hV6tPHelwAzHMgOR
=epFr
-----END PGP SIGNATURE-----
--------------enigD785781B1BF03AF468BB6783--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4910A08A.6050204>