Hello! Help! Can somebody here help me disect and identify what each piece of information means (one by one):
May 4 17:00:48.490494 rule 2/0(match): pass out on rl0: 11.18.0.158.38480 > 11.18.0.1.53: 61994+ AAAA? www.google.com.ph (35)
This is the result given by tcpdump -n -e -ttt -r /var/log/pflog Where's the packet size here?
The (35) is the length, not including IP and UDP headers. See the "UDP Name Server Requests" section in the tcpdump manpage
Also, kindly expound what's 490494 in timestamp 17:00:48.490494 means?
microseconds since 5pm and 48 seconds.
-d
