1.\" $OpenBSD: pflogd.8,v 1.32 2006/12/08 10:26:38 joel Exp $
2.\"
3.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
--- 9 unchanged lines hidden (view full) ---
19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26.\"
27.\" $FreeBSD: head/contrib/pf/pflogd/pflogd.8 171172 2007-07-03 12:30:03Z mlaier $
28.\"
29.Dd July 9, 2001
30.Dt PFLOGD 8
31.Os
32.Sh NAME
33.Nm pflogd
34.Nd packet filter logging daemon
35.Sh SYNOPSIS
36.Nm pflogd
37.Op Fl Dx
38.Op Fl d Ar delay
39.Op Fl f Ar filename
40.Op Fl i Ar interface
41.Op Fl s Ar snaplen
42.Op Ar expression
43.Sh DESCRIPTION
44.Nm
45is a background daemon which reads packets logged by
46.Xr pf 4
47to a
48.Xr pflog 4
49interface, normally
50.Pa pflog0 ,
51and writes the packets to a logfile (normally
52.Pa /var/log/pflog )
53in
54.Xr tcpdump 1
55binary format.
56These logs can be reviewed later using the
57.Fl r
58option of
--- 22 unchanged lines hidden (view full) ---
81If the existing log file was created with a different snaplen,
82.Nm
83temporarily uses the old snaplen to keep the log file consistent.
84.Pp
85.Nm
86tries to preserve the integrity of the log file against I/O errors.
87Furthermore, integrity of an existing log file is verified before
88appending.
89If there is an invalid log file or an I/O error, the log file is moved
90out of the way and a new one is created.
91If a new file cannot be created, logging is suspended until a
92.Dv SIGHUP
93or a
94.Dv SIGALRM
95is received.
96.Pp
97The options are as follows:
98.Bl -tag -width Ds
99.It Fl D
100Debugging mode.
101.Nm
102does not disassociate from the controlling terminal.
103.It Fl d Ar delay
104Time in seconds to delay between automatic flushes of the file.
105This may be specified with a value between 5 and 3600 seconds.
106If not specified, the default is 60 seconds.
107.It Fl f Ar filename
108Log output filename.
109Default is
110.Pa /var/log/pflog .
111.It Fl i Ar interface
112Specifies the
113.Xr pflog 4
114interface to use.
115By default,
116.Nm
117will use
118.Ar pflog0 .
119.It Fl s Ar snaplen
120Analyze at most the first
121.Ar snaplen
122bytes of data from each packet rather than the default of 116.
123The default of 116 is adequate for IP, ICMP, TCP, and UDP headers but may
124truncate protocol information for other protocols.
125Other file parsers may desire a higher snaplen.
126.It Fl x
127Check the integrity of an existing log file, and return.
128.It Ar expression
129Selects which packets will be dumped, using the regular language of
130.Xr tcpdump 1 .
131.El
--- 7 unchanged lines hidden (view full) ---
139.El
140.Sh EXAMPLES
141Log specific tcp packets to a different log file with a large snaplen
142(useful with a log-all rule to dump complete sessions):
143.Bd -literal -offset indent
144# pflogd -s 1600 -f suspicious.log port 80 and host evilhost
145.Ed
146.Pp
147Log from another
148.Xr pflog 4
149interface, excluding specific packets:
150.Bd -literal -offset indent
151# pflogd -i pflog3 -f network3.log "not (tcp and port 23)"
152.Ed
153.Pp
154Display binary logs:
155.Bd -literal -offset indent
156# tcpdump -n -e -ttt -r /var/log/pflog
157.Ed
158.Pp
159Display the logs in real time (this does not interfere with the
160operation of
161.Nm ) :
162.Bd -literal -offset indent
163# tcpdump -n -e -ttt -i pflog0
164.Ed
165.Pp
166Tcpdump has been extended to be able to filter on the pfloghdr
167structure defined in
168.Aq Ar net/if_pflog.h .
169Tcpdump can restrict the output
170to packets logged on a specified interface, a rule number, a reason,
171a direction, an IP family or an action.
172.Pp
173.Bl -tag -width "ruleset authpf " -compact
174.It ip
175Address family equals IPv4.
176.It ip6
177Address family equals IPv6.
178.It ifname kue0
179Interface name equals "kue0".
180.It on kue0
181Interface name equals "kue0".
182.It ruleset authpf
183Ruleset name equals "authpf".
184.It rulenum 10
185Rule number equals 10.
186.It reason match
187Reason equals match.
188Also accepts "bad-offset", "fragment", "bad-timestamp", "short",
189"normalize", "memory", "congestion", "ip-option", "proto-cksum",
190"state-mismatch", "state-insert", "state-limit", "src-limit",
191and "synproxy".
192.It action pass
193Action equals pass.
194Also accepts "block".
195.It inbound
196The direction was inbound.
197.It outbound
198The direction was outbound.
199.El
--- 11 unchanged lines hidden (view full) ---
211.Xr pf.conf 5 ,
212.Xr newsyslog 8
213.Sh HISTORY
214The
215.Nm
216command appeared in
217.Ox 3.0 .
218.Sh AUTHORS
219.Nm
220was written by
221.An Can Erkin Acar Aq canacar@openbsd.org .
2.\"
3.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
--- 9 unchanged lines hidden (view full) ---
19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26.\"
27.\" $FreeBSD: head/contrib/pf/pflogd/pflogd.8 171172 2007-07-03 12:30:03Z mlaier $
28.\"
29.Dd July 9, 2001
30.Dt PFLOGD 8
31.Os
32.Sh NAME
33.Nm pflogd
34.Nd packet filter logging daemon
35.Sh SYNOPSIS
36.Nm pflogd
37.Op Fl Dx
38.Op Fl d Ar delay
39.Op Fl f Ar filename
40.Op Fl i Ar interface
41.Op Fl s Ar snaplen
42.Op Ar expression
43.Sh DESCRIPTION
44.Nm
45is a background daemon which reads packets logged by
46.Xr pf 4
47to a
48.Xr pflog 4
49interface, normally
50.Pa pflog0 ,
51and writes the packets to a logfile (normally
52.Pa /var/log/pflog )
53in
54.Xr tcpdump 1
55binary format.
56These logs can be reviewed later using the
57.Fl r
58option of
--- 22 unchanged lines hidden (view full) ---
81If the existing log file was created with a different snaplen,
82.Nm
83temporarily uses the old snaplen to keep the log file consistent.
84.Pp
85.Nm
86tries to preserve the integrity of the log file against I/O errors.
87Furthermore, integrity of an existing log file is verified before
88appending.
89If there is an invalid log file or an I/O error, the log file is moved
90out of the way and a new one is created.
91If a new file cannot be created, logging is suspended until a
92.Dv SIGHUP
93or a
94.Dv SIGALRM
95is received.
96.Pp
97The options are as follows:
98.Bl -tag -width Ds
99.It Fl D
100Debugging mode.
101.Nm
102does not disassociate from the controlling terminal.
103.It Fl d Ar delay
104Time in seconds to delay between automatic flushes of the file.
105This may be specified with a value between 5 and 3600 seconds.
106If not specified, the default is 60 seconds.
107.It Fl f Ar filename
108Log output filename.
109Default is
110.Pa /var/log/pflog .
111.It Fl i Ar interface
112Specifies the
113.Xr pflog 4
114interface to use.
115By default,
116.Nm
117will use
118.Ar pflog0 .
119.It Fl s Ar snaplen
120Analyze at most the first
121.Ar snaplen
122bytes of data from each packet rather than the default of 116.
123The default of 116 is adequate for IP, ICMP, TCP, and UDP headers but may
124truncate protocol information for other protocols.
125Other file parsers may desire a higher snaplen.
126.It Fl x
127Check the integrity of an existing log file, and return.
128.It Ar expression
129Selects which packets will be dumped, using the regular language of
130.Xr tcpdump 1 .
131.El
--- 7 unchanged lines hidden (view full) ---
139.El
140.Sh EXAMPLES
141Log specific tcp packets to a different log file with a large snaplen
142(useful with a log-all rule to dump complete sessions):
143.Bd -literal -offset indent
144# pflogd -s 1600 -f suspicious.log port 80 and host evilhost
145.Ed
146.Pp
147Log from another
148.Xr pflog 4
149interface, excluding specific packets:
150.Bd -literal -offset indent
151# pflogd -i pflog3 -f network3.log "not (tcp and port 23)"
152.Ed
153.Pp
154Display binary logs:
155.Bd -literal -offset indent
156# tcpdump -n -e -ttt -r /var/log/pflog
157.Ed
158.Pp
159Display the logs in real time (this does not interfere with the
160operation of
161.Nm ) :
162.Bd -literal -offset indent
163# tcpdump -n -e -ttt -i pflog0
164.Ed
165.Pp
166Tcpdump has been extended to be able to filter on the pfloghdr
167structure defined in
168.Aq Ar net/if_pflog.h .
169Tcpdump can restrict the output
170to packets logged on a specified interface, a rule number, a reason,
171a direction, an IP family or an action.
172.Pp
173.Bl -tag -width "ruleset authpf " -compact
174.It ip
175Address family equals IPv4.
176.It ip6
177Address family equals IPv6.
178.It ifname kue0
179Interface name equals "kue0".
180.It on kue0
181Interface name equals "kue0".
182.It ruleset authpf
183Ruleset name equals "authpf".
184.It rulenum 10
185Rule number equals 10.
186.It reason match
187Reason equals match.
188Also accepts "bad-offset", "fragment", "bad-timestamp", "short",
189"normalize", "memory", "congestion", "ip-option", "proto-cksum",
190"state-mismatch", "state-insert", "state-limit", "src-limit",
191and "synproxy".
192.It action pass
193Action equals pass.
194Also accepts "block".
195.It inbound
196The direction was inbound.
197.It outbound
198The direction was outbound.
199.El
--- 11 unchanged lines hidden (view full) ---
211.Xr pf.conf 5 ,
212.Xr newsyslog 8
213.Sh HISTORY
214The
215.Nm
216command appeared in
217.Ox 3.0 .
218.Sh AUTHORS
219.Nm
220was written by
221.An Can Erkin Acar Aq canacar@openbsd.org .