Yes but the main problem is not the displaying just the header, is to save the header. We have some space issue in the /var and I would to reduce the usage saving just the headers of the packets. I wonder if there is a way to tell pf to log the header as we have also some privacy issue logging all the packets. We just can't do this.
But probably is a pcap related problem, pcap must save the payload too.....isn't it?
