Subject: Re: pflog on NetBSD
To: Michael-John Turner <firstname.lastname@example.org>
From: Brian A. Seklecki <email@example.com>
Date: 09/21/2006 18:25:40
> I'm probably missing something here, but mine looks OK:
> 27. 464232 rule 0/0(match): block in on pppoe0:
> IP (tos 0x0, ttl 59, id 9203, offset 0, flags [DF], length: 48)
> 220.127.116.11.56771 > 18.104.22.168.25: S [tcp sum ok]
> 3012356060:3012356060(0) win 24820 <nop,nop,sackOK,mss 1440>
Interesting. I was entertaining the idea tha tit may be a configuration
issue. Your pf.conf(5) has a 'block log all' near the beginning?
There is an issue of an "old pflog format" v.s. the current one, but I
think we can rule that out.
> (line wrapped manually for readability).
> This is on a NetBSD 3.0_STABLE system, custom kernel with pf built in
> rather than an lkm, running the following:
> tcpdump version 3.8.3
> libpcap version 0.8.3
> Michael-John Turner | http://mjturner.net/
> firstname.lastname@example.org | Open Source in WC ZA - http://www.clug.org.za/
-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
"...from back in the heady days when "helpdesk" meant nothing, "diskquota"
meant everything, and lives could be bought and sold for a couple of pages
of laser printout - and frequently were."