pflog man page on FreeBSD

Man page or keyword search:  
man Server   9747 pages
apropos Keyword Search (all sections)
Output format
FreeBSD logo
[printable version]

PFLOG(4)		 BSD Kernel Interfaces Manual		      PFLOG(4)

     pflog — packet filter logging interface

     device pflog

     The pflog interface is a pseudo-device which makes visible all packets
     logged by the packet filter, pf(4).  Logged packets can easily be moni‐
     tored in real time by invoking tcpdump(1) on the pflog interface, or
     stored to disk using pflogd(8).

     The pflog0 interface is created automatically at boot if both pf(4) and
     pflogd(8) are enabled; further instances can be created using

     Each packet retrieved on this interface has a header associated with it
     of length PFLOG_HDRLEN.  This header documents the address family, inter‐
     face name, rule number, reason, action, and direction of the packet that
     was logged.  This structure, defined in ⟨net/if_pflog.h⟩ looks like

	   struct pfloghdr {
		   u_int8_t	   length;
		   sa_family_t	   af;
		   u_int8_t	   action;
		   u_int8_t	   reason;
		   char		   ifname[IFNAMSIZ];
		   char		   ruleset[PF_RULESET_NAME_SIZE];
		   u_int32_t	   rulenr;
		   u_int32_t	   subrulenr;
		   uid_t	   uid;
		   pid_t	   pid;
		   uid_t	   rule_uid;
		   pid_t	   rule_pid;
		   u_int8_t	   dir;
		   u_int8_t	   pad[3];

     Create a pflog interface and monitor all packets logged on it:

	   # ifconfig pflog1 up
	   # tcpdump -n -e -ttt -i pflog1

     tcpdump(1) inet(4), inet6(4), netintro(4), pf(4), ifconfig(8), pflogd(8)

     The pflog device first appeared in OpenBSD 3.0.

BSD			       December 10, 2001			   BSD

List of man pages available for FreeBSD

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
Vote for polarhome
Free Shell Accounts :: the biggest list on the net