Subject: Re: pflog on NetBSD
To: Jeremy C. Reed <reed@reedmedia.net>
From: Brian A. Seklecki <lavalamp@spiritual-machines.org>
List: netbsd-users
Date: 09/18/2006 08:27:23
Good call.  I'll try Pkgsrc.

~BAS

On Fri, 15 Sep 2006, Jeremy C. Reed wrote:

>> On the same subject, has anyone noticed the different format of pflog(4) on
>> NetBSD v.s. OpenBSD.  Specifically, for ICMP/TCP/UDP, the type/port is absent
>> from the source/destination address:
>>
>>  OpenBSD pflog(4) line:
>>
>> Sep 15 21:47:46.420650 rule 0/(match) block out on vlan40:
>> 206.210.89.202.62343 > 67.72.4.94.80: R 1515499462:1515499462(0) ack
>> 2101925191 win 0
>>
>>  NetBSD pflog(4) line:
>>
>> 015133 rule 0/0(match): block in on fxp0: IP 206.210.112.118 > 206.210.72.83:
>> [|tcp]
>>
>> TCP/UDP port = missing
>>
>> This is with: # tcpdump -ttt -e -vvv -i pflog0 -e -n on both.
>>
>> I'll open a PR.
>
> The tcpdump code (such as print-pflog.c) is different. Maybe updating will
> correct this?
>

l8*
 	-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
 	       http://www.spiritual-machines.org/

"...from back in the heady days when "helpdesk" meant nothing, "diskquota"
meant everything, and lives could be bought and sold for a couple of pages
of laser printout - and frequently were."