Date: Mon, 19 Oct 2009 19:33:37 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: =?ISO-8859-1?Q?D=E1nielisz_L=E1szl=F3?= <laszlo_danielisz@yahoo.com> Cc: freebsd-questions@freebsd.org Subject: Re: pf+time stamp Message-ID: <4ADCB101.808@infracaninophile.co.uk> In-Reply-To: <823621.39942.qm@web30801.mail.mud.yahoo.com> References: <823621.39942.qm@web30801.mail.mud.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigA35BFECD1437B97DA6E016A8
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
D=E1nielisz L=E1szl=F3 wrote:
> Hello,
>=20
> Do you have any idea how to add and read time stamp of pf/pf.log?
>=20
> Thank you!
> Laci
Do you mean /var/log/pflog ? Which is the default location where a
record of logged packets ends up if you run pflogd(8).
That's actually a pcap (packet capture) file, and you can read it
using tcpdump:
# tcpdump -r /var/log/pflog
Each packet is recorded with a high resolution timestamp that tcpdump
will display for you -- like this naughty chap suffering the consequences=
of trying to brute-force my ssh daemon just before 1:00pm today:
12:52:44.891373 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: . ack 2991958242 win 1460 <nop,n=
op,timestamp 2 9319378 1107347817,[|tcp]>
12:52:45.516283 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209319535 1107347817>
12:52:48.387822 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209320253 1107347817>
12:52:54.131863 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209321689 1107347817>
12:52:57.113810 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: . ack 1 win 1460 <nop,nop,timest=
amp 209322434 1107347817,[|tcp]>
12:53:05.620251 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209324561 1107347817>
12:53:28.597524 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209330305 1107347817>
12:54:14.550822 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209341793 1107347817>
12:55:46.457353 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop=
,timestamp 209364769 1107347817>
13:00:15.032146 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happ=
y-idiot-talk.infracaninophile.co.uk.ssh: R 1230911050:1230911050(0) win 1=
460
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enigA35BFECD1437B97DA6E016A8
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.13 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAkrcsQgACgkQ8Mjk52CukIzoHQCbBnb8XAV8sevPaQ07tMKyJPN/
uloAmgIYWlM5vXQEmZsLfCPiTWBHn3Ne
=m7gg
-----END PGP SIGNATURE-----
--------------enigA35BFECD1437B97DA6E016A8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4ADCB101.808>