Date: Tue, 13 Dec 2005 18:12:40 +0300 From: Gleb Smirnoff <glebius@FreeBSD.org> To: Luigi Rizzo <rizzo@icir.org> Cc: cvs-src@FreeBSD.org, Poul-Henning Kamp <phk@phk.freebsd.dk>, src-committers@FreeBSD.org, Alexey Dokuchaev <danfe@FreeBSD.org>, cvs-all@FreeBSD.org Subject: Re: ipfw2 logs to bpf (was Re: cvs commit: src/sbin/ipfw ipfw2.c...) Message-ID: <20051213151240.GJ37414@FreeBSD.org> In-Reply-To: <20051213070846.A10708@xorpc.icir.org> References: <20051213061503.A10373@xorpc.icir.org> <12911.1134485339@critter.freebsd.dk> <20051213070846.A10708@xorpc.icir.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 13, 2005 at 07:08:47AM -0800, Luigi Rizzo wrote: L> On Tue, Dec 13, 2005 at 03:48:59PM +0100, Poul-Henning Kamp wrote: L> > In message <20051213061503.A10373@xorpc.icir.org>, Luigi Rizzo writes: L> > L> > >talking about ipfw2, a couple of years ago i posted some code for 4.x L> > >to let ipfw2 "log" packets to a pseudo interface called /dev/ipfw0 so L> > >that people in need of detailed logging could just get it from L> > >there through tcpdump or whatever. L> > L> > Isn't it easier to use ipfwpcap(8) and a divert socket ? L> L> well apart that i just learned about it from this email and couldn't L> find a manpage, they are similar in spirit but they don't seem to L> do exactly the same thing: L> L> - 'log' is an option that you can set on any ipfw rule, independently L> from the action; L> - ipfwpcap only works on divert or tee rules (i read in the code L> that tee is broken but assume it can be fixed so the performance L> objection for the -r option will not matter, eventually). AFAIK, "tee" is not broken since Andre has made ipfw to use pfil(9) framework. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051213151240.GJ37414>