Re: Setting a rule for NPF

[christos%astron.com@localhost (Christos Zoulas)]

In article <trinity-d1d87efd-2159-4e9a-a019-1bf32e66a33a-1420217178333@3capp-mailcom-lxa11>,
Rocky Hotas <rockyhotas%post.com@localhost> wrote:
>With the /etc/npf.conf file as below
>
>procedure "log" {
>log: npflog0
>}
>
>group (default) {
>pass all
>pass final family inet proto icmp all apply "log"
>}
>
>it works.
>I can read the log by running "tcpdump -i npflog0". But is there an
>easier way to have the log? 
>I would like to automatically redirect the log to a file without keeping
>active tcpdump.

No, there is currently no way. You would need a helper userland
process to read the data out from the device (it is nasty to have
the kernel write directly to the filesystem). I've been thinking
about writing a small logger for npf that logs via syslog, but then
the only thing I would achieve would be to lose the bits of the
original data for the benefit of user pretty printing.

To do this, the obvious way would be to turn tcpdump into a library,
or change the main tcpdump program to do handle this. Both are
non-trivial tasks. If I feel bored someday :-)

christos