Date: Fri, 2 May 2008 03:05:37 +0100 From: Drav Sloan <holbs@real-life.tm> To: freebsd-pf@freebsd.org Subject: a buildworld yeilds tcpdump oddness Message-ID: <20080502020537.GA70377@real-life.tm>
next in thread | raw e-mail | index | archive | help
Hiya all! I'm fairly new to pf and have recently set up a firewall using it. After getting things up and running I decided to cvsup and buildworld 7.0-RELEASE branch. However odd things started appaearing with the output of tcpdump when the old 'tcpdump -n -e -ttt -i pflog0" is used. Instead of the usual output I now get: tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 68 bytes 000000 rule 6/0(match): block in on re0: [|ip] 000058 rule 6/0(match): block in on re0: [|ip] 300. 033021 rule 6/0(match): block in on re0: [|ip] 000056 rule 6/0(match): block in on re0: [|ip] 368. 212637 rule 6/0(match): block in on re0: [|ip] 000059 rule 6/0(match): block in on re0: [|ip] As you can see the actual traffic being blocked is not "present", so it's about as much use as Boris in a mayorial election (as I've no idea _what_ is being blocked). Has anyone come across this before? Have I done something dumb with my configs that have nuked the pflog0 output? Any ideas how I can kick this up the arse? _Strangely_ a tcpdump of the /var/log/pflog yeilds the expected behaviour: # tcpdump -n -e -ttt -r /var/log/pflog reading from file /var/log/pflog, link-type PFLOG (OpenBSD pflog file) . . 368. 212637 rule 6/0(match): block in on re0: 10.0.0.1.138 > 10.0.0.255.138: NBT UDP PACKET(138) 000059 rule 6/0(match): block in on re0: 10.0.0.1.138 > 10.0.0.255.138: NBT UDP PACKET(138) I'm stumped :/ Cheers in advanced for any cl00 offered :D Regards Drav.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080502020537.GA70377>