1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
.\" $OpenBSD: pflogd.8,v 1.12 2002/02/28 22:27:33 dhartmei Exp $
.\"
.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 3. The name of the author may not be used to endorse or promote products
.\" derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd July 9, 2001
.Dt PFLOGD 8
.Os
.Sh NAME
.Nm pflogd
.Nd packet filter logging daemon
.Sh SYNOPSIS
.Nm pflogd
.Op Fl D
.Op Fl d Ar delay
.Op Fl f Ar filename
.Op Fl s Ar snaplen
.Op Ar expression
.Sh DESCRIPTION
.Nm
is a background daemon which reads packets logged by
.Xr pf 4
to the packet logging interface
.Pa pflog0
and writes the packets to a logfile (normally
.Pa /var/log/pflog )
in
.Xr tcpdump 8
binary format.
These logs can be reviewed later using the
.Ar -r
option of
.Xr tcpdump 8 ,
hopefully offline in case there are bugs in the packet parsing code of
.Xr tcpdump 8 .
.Pp
.Nm
closes and then re-opens the log file when it receives
.Va SIGHUP ,
permitting
.Xr newsyslog 8
to rotate logfiles automatically.
.Va SIGALRM
causes
.Nm
to flush the current logfile buffers to the disk, thus making the most
recent logs available.
The buffers are also flushed every
.Ar delay
seconds.
.Pp
If the log file contains data after a restart or a
.Va SIGHUP ,
new logs are appended to the existing file.
If the existing log file was created with a different snaplen,
.Nm
temporarily uses the old snaplen to keep the log file consistent.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl d Ar delay
Time in seconds to delay between automatic flushes of the file.
This may be specified with a value between 5 and 3600 seconds.
If not specified, the default is 60 seconds.
.It Fl D
Debugging mode.
.Nm
does not disassociate from the controlling terminal.
.It Fl f Ar filename
Log output filename.
Default is
.Pa /var/log/pflog .
.It Fl s Ar snaplen
Analyze at most the first
.Ar snaplen
bytes of data from each packet rather than the default of 96.
The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may
truncate protocol information for other protocols.
Other file parsers may desire a higher snaplen.
.It Ar expression
selects which packets will be dumped, using the regular language of
.Xr tcpdump 8 .
.El
.Sh EXAMPLES
Log specific tcp packets to a different log file with a large snaplen
(useful with a log-all rule to dump complete sessions)
.Bd -literal -offset indent
# pflogd -s 1600 -f suspicious.log port 80 and host evilhost
.Ed
.Pp
Display binary logs:
.Bd -literal -offset indent
# tcpdump -n -e -ttt -r /var/log/pflog
.Ed
.Pp
Display the logs in real time (this does not interfere with the
operation of pflogd):
.Bd -literal -offset indent
# ifconfig pflog0 up
# tcpdump -n -e -ttt -i pflog0
.Ed
.Pp
The ethernet protocol layer of packets logged by pflogd consists
of an object of type struct pfloghdr (defined in net/if_pflog.h),
which allows to use the following tcpdump expressions to filter on
pf specific criteria:
.Bl -tag -width "ether[99:9]=0xFFFFFFFF " -compact
.It ether[0:4]=4
Address family equals IPv4 (4) or IPv6 (24).
.It ether[4:4]=0x6b756530
Interface name equals "kue0" (0x6b756530).
.It ether[20:2]=10
Rule number equals 10.
.It ether[22:2]=0
Reason equals match (0), bad offset (1), fragment (2), short (3),
normalization (4) or memory (5).
.It ether[24:2]=0
Action equals pass (0) or block (1).
.It ether[26:2]=0
Direction equals in (0) or out (1).
.El
.Sh FILES
.Bl -tag -width /var/run/pflogd.pid -compact
.It Pa /var/run/pflogd.pid
process ID of current
.It Pa /var/log/pflog
Default log file
.El
.Sh SEE ALSO
.Xr pcap 3 ,
.Xr pf 4 ,
.Xr pf.conf 5 ,
.Xr pflog 4 ,
.Xr newsyslog 8 ,
.Xr tcpdump 8
.Sh AUTHORS
Can Erkin Acar
.Sh HISTORY
The
.Nm
command appeared in
.Ox 3.0 .
|
