1*86d7f5d3SJohn Marino.\" $OpenBSD: pflog.4,v 1.10 2007/05/31 19:19:51 jmc Exp $ 2*86d7f5d3SJohn Marino.\" 3*86d7f5d3SJohn Marino.\" Copyright (c) 2001 Tobias Weingartner 4*86d7f5d3SJohn Marino.\" All rights reserved. 5*86d7f5d3SJohn Marino.\" 6*86d7f5d3SJohn Marino.\" Redistribution and use in source and binary forms, with or without 7*86d7f5d3SJohn Marino.\" modification, are permitted provided that the following conditions 8*86d7f5d3SJohn Marino.\" are met: 9*86d7f5d3SJohn Marino.\" 1. Redistributions of source code must retain the above copyright 10*86d7f5d3SJohn Marino.\" notice, this list of conditions and the following disclaimer. 11*86d7f5d3SJohn Marino.\" 2. Redistributions in binary form must reproduce the above copyright 12*86d7f5d3SJohn Marino.\" notice, this list of conditions and the following disclaimer in the 13*86d7f5d3SJohn Marino.\" documentation and/or other materials provided with the distribution. 14*86d7f5d3SJohn Marino.\" 15*86d7f5d3SJohn Marino.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16*86d7f5d3SJohn Marino.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17*86d7f5d3SJohn Marino.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18*86d7f5d3SJohn Marino.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19*86d7f5d3SJohn Marino.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20*86d7f5d3SJohn Marino.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21*86d7f5d3SJohn Marino.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22*86d7f5d3SJohn Marino.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23*86d7f5d3SJohn Marino.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24*86d7f5d3SJohn Marino.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25*86d7f5d3SJohn Marino.\" 26*86d7f5d3SJohn Marino.Dd December 10, 2001 27*86d7f5d3SJohn Marino.Dt PFLOG 4 28*86d7f5d3SJohn Marino.Os 29*86d7f5d3SJohn Marino.Sh NAME 30*86d7f5d3SJohn Marino.Nm pflog 31*86d7f5d3SJohn Marino.Nd packet filter logging interface 32*86d7f5d3SJohn Marino.Sh SYNOPSIS 33*86d7f5d3SJohn Marino.Cd "device pflog" 34*86d7f5d3SJohn Marino.Sh DESCRIPTION 35*86d7f5d3SJohn MarinoThe 36*86d7f5d3SJohn Marino.Nm 37*86d7f5d3SJohn Marinointerface is a pseudo-device which makes visible all packets logged by 38*86d7f5d3SJohn Marinothe packet filter, 39*86d7f5d3SJohn Marino.Xr pf 4 . 40*86d7f5d3SJohn MarinoLogged packets can easily be monitored in real 41*86d7f5d3SJohn Marinotime by invoking 42*86d7f5d3SJohn Marino.Xr tcpdump 1 43*86d7f5d3SJohn Marinoon the 44*86d7f5d3SJohn Marino.Nm 45*86d7f5d3SJohn Marinointerface, or stored to disk using 46*86d7f5d3SJohn Marino.Xr pflogd 8 . 47*86d7f5d3SJohn Marino.Pp 48*86d7f5d3SJohn MarinoThe pflog0 interface is created automatically at boot if both 49*86d7f5d3SJohn Marino.Xr pf 4 50*86d7f5d3SJohn Marinoand 51*86d7f5d3SJohn Marino.Xr pflogd 8 52*86d7f5d3SJohn Marinoare enabled; 53*86d7f5d3SJohn Marinofurther instances can be created using 54*86d7f5d3SJohn Marino.Xr ifconfig 8 . 55*86d7f5d3SJohn Marino.Pp 56*86d7f5d3SJohn MarinoEach packet retrieved on this interface has a header associated 57*86d7f5d3SJohn Marinowith it of length 58*86d7f5d3SJohn Marino.Dv PFLOG_HDRLEN . 59*86d7f5d3SJohn MarinoThis header documents the address family, interface name, rule 60*86d7f5d3SJohn Marinonumber, reason, action, and direction of the packet that was logged. 61*86d7f5d3SJohn MarinoThis structure, defined in 62*86d7f5d3SJohn Marino.In net/pf/if_pflog.h 63*86d7f5d3SJohn Marinolooks like 64*86d7f5d3SJohn Marino.Bd -literal -offset indent 65*86d7f5d3SJohn Marinostruct pfloghdr { 66*86d7f5d3SJohn Marino u_int8_t length; 67*86d7f5d3SJohn Marino sa_family_t af; 68*86d7f5d3SJohn Marino u_int8_t action; 69*86d7f5d3SJohn Marino u_int8_t reason; 70*86d7f5d3SJohn Marino char ifname[IFNAMSIZ]; 71*86d7f5d3SJohn Marino char ruleset[PF_RULESET_NAME_SIZE]; 72*86d7f5d3SJohn Marino u_int32_t rulenr; 73*86d7f5d3SJohn Marino u_int32_t subrulenr; 74*86d7f5d3SJohn Marino uid_t uid; 75*86d7f5d3SJohn Marino pid_t pid; 76*86d7f5d3SJohn Marino uid_t rule_uid; 77*86d7f5d3SJohn Marino pid_t rule_pid; 78*86d7f5d3SJohn Marino u_int8_t dir; 79*86d7f5d3SJohn Marino u_int8_t pad[3]; 80*86d7f5d3SJohn Marino}; 81*86d7f5d3SJohn Marino.Ed 82*86d7f5d3SJohn Marino.Sh EXAMPLES 83*86d7f5d3SJohn MarinoCreate a 84*86d7f5d3SJohn Marino.Nm 85*86d7f5d3SJohn Marinointerface 86*86d7f5d3SJohn Marinoand monitor all packets logged on it: 87*86d7f5d3SJohn Marino.Bd -literal -offset indent 88*86d7f5d3SJohn Marino# ifconfig pflog0 up 89*86d7f5d3SJohn Marino# tcpdump -n -e -ttt -i pflog0 90*86d7f5d3SJohn Marino.Ed 91*86d7f5d3SJohn Marino.Sh SEE ALSO 92*86d7f5d3SJohn Marino.Xr tcpdump 1 , 93*86d7f5d3SJohn Marino.Xr inet 4 , 94*86d7f5d3SJohn Marino.Xr inet6 4 , 95*86d7f5d3SJohn Marino.Xr netintro 4 , 96*86d7f5d3SJohn Marino.Xr pf 4 , 97*86d7f5d3SJohn Marino.Xr ifconfig 8 , 98*86d7f5d3SJohn Marino.Xr pflogd 8 99*86d7f5d3SJohn Marino.Sh HISTORY 100*86d7f5d3SJohn MarinoThe 101*86d7f5d3SJohn Marino.Nm 102*86d7f5d3SJohn Marinodevice first appeared in 103*86d7f5d3SJohn Marino.Ox 3.0 104*86d7f5d3SJohn Marinoand was then integrated into 105*86d7f5d3SJohn Marino.Dx 1.1 106*86d7f5d3SJohn Marinoby Devon H. O'Dell and Simon Schubert. 107*86d7f5d3SJohn Marino.\" .Sh BUGS 108*86d7f5d3SJohn Marino.\" Anything here? 109