cpghost wrote:
How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the captured packets are not the same size. This seems to work: $ tcpdump -n -s 116 -i pflog0 but now, both tcpdump and pflogd are competing for the same interface pflog0. I'm afraid that in the latter case, every packet will be EITHER logged by pflogd XOR displayed by tcpdump. Is that so? If yes, /var/log/pflog would be incomplete, because some packets would have been snatched away from pflog0 by tcpdump, before pflogd ever got a chance to read them out. Is there a way to watch /var/log/pflog grow, while still making sure that pflogd logs EVERY packet that appears on the pflog0 interface? How?
Running tcpdump against the pflog0 pseudo-interface no more stops
pflogd recording the traffic than running tcpdump on your network
interface blocks traffic from the net.
tcpdump -vv -i pflog0
really is the way to go if you want to see what your firewall is
logging in real time.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
signature.asc
Description: OpenPGP digital signature
