On Tue, Nov 04, 2008 at 07:20:42PM +0000, Matthew Seaman wrote: > cpghost wrote: > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn't start at the right location. > > > > Using a blocksize (-b) with tail may also not be right, > > because the captured packets are not the same size. > > > > This seems to work: > > $ tcpdump -n -s 116 -i pflog0 > > but now, both tcpdump and pflogd are competing for the same > > interface pflog0. > > > > I'm afraid that in the latter case, every packet will be > > EITHER logged by pflogd > > XOR displayed by tcpdump. > > Is that so? > > > > If yes, /var/log/pflog would be incomplete, because some packets > > would have been snatched away from pflog0 by tcpdump, before > > pflogd ever got a chance to read them out. > > > > Is there a way to watch /var/log/pflog grow, while > > still making sure that pflogd logs EVERY packet that appears > > on the pflog0 interface? How? > > > > Running tcpdump against the pflog0 pseudo-interface no more stops > pflogd recording the traffic than running tcpdump on your network > interface blocks traffic from the net.
Ah, okay. pflog0 therefore delivers a *copy* of the packets to all subscribers. That's good to know! > tcpdump -vv -i pflog0 > > really is the way to go if you want to see what your firewall is > logging in real time. Yep, will do. Thanks for helping. -cpghost. > Cheers, > > Matthew > > -- > Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard > Flat 3 > PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate > Kent, CT11 9PW -- Cordula's Web. http://www.cordula.ws/ _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
