On Mon, Feb 09, 2004 at 04:40:54PM +1100, Craig Bennett wrote: > Hi All, > > I would like to determine how much traffic each rule matches. Ideally I > would like the packet length to appear in the system logs.
you can get the same information from per-rule counters, try pfctl -vsr > I haved looked at the man page for tcpdump and it says the for pflog data, > the link-level header shows information from pf. Does anyone know how I can > add a length to this? If you still need this, packet length is already in bpf header, subtract pflog header length if you need the packet length. see bpf(4), pcap(3) for more info.
