From owner-freebsd-current@FreeBSD.ORG Sun Aug 29 01:16:24 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 973A616A4CE for ; Sun, 29 Aug 2004 01:16:24 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.171]) by mx1.FreeBSD.org (Postfix) with ESMTP id 35E3E43D5C for ; Sun, 29 Aug 2004 01:16:24 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.209] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1C1EIx-0001wn-00; Sun, 29 Aug 2004 03:16:23 +0200 Received: from [217.83.3.59] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1C1EIw-0000vH-00; Sun, 29 Aug 2004 03:16:23 +0200 From: Max Laier To: freebsd-current@freebsd.org, erik.u@dnainternet.net Date: Sun, 29 Aug 2004 03:14:38 +0200 User-Agent: KMail/1.6.2 References: <413102D4.60804@dnainternet.net> In-Reply-To: <413102D4.60804@dnainternet.net> MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Boundary-02=_M4SMBTUMjySxn33"; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200408290314.52675.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 Subject: Re: Trying to see pf's logs using tcpdump X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Aug 2004 01:16:24 -0000 --Boundary-02=_M4SMBTUMjySxn33 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Sunday 29 August 2004 00:10, Erik U. wrote: > On FreeBSD 5.2.1. > > I installed pf from the ports, configured and ran it. > I just get this error when trying to watch pf's logs: > > [root@nat] ~ $ tcpdump -n -e -ttt -r /var/log/pflog > tcpdump: unknown data link type 117 prefix this with "pf" as: [root@nat] ~ $ pftcpdump -n -e -ttt -r /var/log/pflog and you should be fine. > Why can't they just put the logs in text not in some damn binary.. It's not "some damn binary" it's a pcap file and it is uses as it has *all*= =20 the information and not just some obscure bits that the developer though=20 might be interesting. The great benefit of this is the ability to pass the= =20 pflog-output (more or less) unmodified to an IDS which usually needs more=20 information than most of the plain-text logs will give you. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --Boundary-02=_M4SMBTUMjySxn33 Content-Type: application/pgp-signature Content-Description: signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQBBMS4MXyyEoT62BG0RAqVAAJ4qwOZSlRsFRKcPztSX3MON5pA0tgCfRWQf mDhSP/bn3cUjP7ZDR0miHoI= =Hnhe -----END PGP SIGNATURE----- --Boundary-02=_M4SMBTUMjySxn33--