1.\" $OpenBSD: pflogd.8,v 1.25 2005/01/02 18:15:02 jmc Exp $
2.\"
3.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
--- 9 unchanged lines hidden (view full) ---
19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26.\"
27.\" $FreeBSD: head/contrib/pf/pflogd/pflogd.8 148787 2005-08-06 13:03:03Z brueffer $
28.\"
29.Dd July 9, 2001
30.Dt PFLOGD 8
31.Os
32.Sh NAME
33.Nm pflogd
34.Nd packet filter logging daemon
35.Sh SYNOPSIS
36.Nm pflogd
37.Op Fl Dx
38.Op Fl d Ar delay
39.Op Fl f Ar filename
40.Op Fl s Ar snaplen
41.Op Ar expression
42.Sh DESCRIPTION
43.Nm
44is a background daemon which reads packets logged by
45.Xr pf 4
46to the packet logging interface
47.Pa pflog0
48and writes the packets to a logfile (normally
49.Pa /var/log/pflog )
50in
51.Xr tcpdump 1
52binary format.
53These logs can be reviewed later using the
54.Fl r
55option of
--- 22 unchanged lines hidden (view full) ---
78If the existing log file was created with a different snaplen,
79.Nm
80temporarily uses the old snaplen to keep the log file consistent.
81.Pp
82.Nm
83tries to preserve the integrity of the log file against I/O errors.
84Furthermore, integrity of an existing log file is verified before
85appending.
86If there is an invalid log file or an I/O error, logging is suspended until a
87.Dv SIGHUP
88or a
89.Dv SIGALRM
90is received.
91.Pp
92The options are as follows:
93.Bl -tag -width Ds
94.It Fl D
95Debugging mode.
96.Nm
97does not disassociate from the controlling terminal.
98.It Fl d Ar delay
99Time in seconds to delay between automatic flushes of the file.
100This may be specified with a value between 5 and 3600 seconds.
101If not specified, the default is 60 seconds.
102.It Fl f Ar filename
103Log output filename.
104Default is
105.Pa /var/log/pflog .
106.It Fl s Ar snaplen
107Analyze at most the first
108.Ar snaplen
109bytes of data from each packet rather than the default of 96.
110The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may
111truncate protocol information for other protocols.
112Other file parsers may desire a higher snaplen.
113.It Fl x
114Check the integrity of an existing log file, and return.
115.It Ar expression
116Selects which packets will be dumped, using the regular language of
117.Xr tcpdump 1 .
118.El
--- 7 unchanged lines hidden (view full) ---
126.El
127.Sh EXAMPLES
128Log specific tcp packets to a different log file with a large snaplen
129(useful with a log-all rule to dump complete sessions):
130.Bd -literal -offset indent
131# pflogd -s 1600 -f suspicious.log port 80 and host evilhost
132.Ed
133.Pp
134Display binary logs:
135.Bd -literal -offset indent
136# tcpdump -n -e -ttt -r /var/log/pflog
137.Ed
138.Pp
139Display the logs in real time (this does not interfere with the
140operation of
141.Nm ) :
142.Bd -literal -offset indent
143# tcpdump -n -e -ttt -i pflog0
144.Ed
145.Pp
146Tcpdump has been extended to be able to filter on the pfloghdr
147structure defined in
148.Aq Ar net/if_pflog.h .
149Tcpdump can restrict the output
150to packets logged on a specified interface, a rule number, a reason,
151a direction, an IP family or an action.
152.Pp
153.Bl -tag -width "reason match " -compact
154.It ip
155Address family equals IPv4.
156.It ip6
157Address family equals IPv6.
158.It ifname kue0
159Interface name equals "kue0".
160.It on kue0
161Interface name equals "kue0".
162.It rulenum 10
163Rule number equals 10.
164.It reason match
165Reason equals match.
166Also accepts "bad-offset", "fragment", "bad-timestamp", "short",
167"normalize" and "memory".
168.It action pass
169Action equals pass.
170Also accepts "block".
171.It inbound
172The direction was inbound.
173.It outbound
174The direction was outbound.
175.El
--- 11 unchanged lines hidden (view full) ---
187.Xr pf.conf 5 ,
188.Xr newsyslog 8
189.Sh HISTORY
190The
191.Nm
192command appeared in
193.Ox 3.0 .
194.Sh AUTHORS
195Can Erkin Acar
2.\"
3.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
--- 9 unchanged lines hidden (view full) ---
19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26.\"
27.\" $FreeBSD: head/contrib/pf/pflogd/pflogd.8 148787 2005-08-06 13:03:03Z brueffer $
28.\"
29.Dd July 9, 2001
30.Dt PFLOGD 8
31.Os
32.Sh NAME
33.Nm pflogd
34.Nd packet filter logging daemon
35.Sh SYNOPSIS
36.Nm pflogd
37.Op Fl Dx
38.Op Fl d Ar delay
39.Op Fl f Ar filename
40.Op Fl s Ar snaplen
41.Op Ar expression
42.Sh DESCRIPTION
43.Nm
44is a background daemon which reads packets logged by
45.Xr pf 4
46to the packet logging interface
47.Pa pflog0
48and writes the packets to a logfile (normally
49.Pa /var/log/pflog )
50in
51.Xr tcpdump 1
52binary format.
53These logs can be reviewed later using the
54.Fl r
55option of
--- 22 unchanged lines hidden (view full) ---
78If the existing log file was created with a different snaplen,
79.Nm
80temporarily uses the old snaplen to keep the log file consistent.
81.Pp
82.Nm
83tries to preserve the integrity of the log file against I/O errors.
84Furthermore, integrity of an existing log file is verified before
85appending.
86If there is an invalid log file or an I/O error, logging is suspended until a
87.Dv SIGHUP
88or a
89.Dv SIGALRM
90is received.
91.Pp
92The options are as follows:
93.Bl -tag -width Ds
94.It Fl D
95Debugging mode.
96.Nm
97does not disassociate from the controlling terminal.
98.It Fl d Ar delay
99Time in seconds to delay between automatic flushes of the file.
100This may be specified with a value between 5 and 3600 seconds.
101If not specified, the default is 60 seconds.
102.It Fl f Ar filename
103Log output filename.
104Default is
105.Pa /var/log/pflog .
106.It Fl s Ar snaplen
107Analyze at most the first
108.Ar snaplen
109bytes of data from each packet rather than the default of 96.
110The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may
111truncate protocol information for other protocols.
112Other file parsers may desire a higher snaplen.
113.It Fl x
114Check the integrity of an existing log file, and return.
115.It Ar expression
116Selects which packets will be dumped, using the regular language of
117.Xr tcpdump 1 .
118.El
--- 7 unchanged lines hidden (view full) ---
126.El
127.Sh EXAMPLES
128Log specific tcp packets to a different log file with a large snaplen
129(useful with a log-all rule to dump complete sessions):
130.Bd -literal -offset indent
131# pflogd -s 1600 -f suspicious.log port 80 and host evilhost
132.Ed
133.Pp
134Display binary logs:
135.Bd -literal -offset indent
136# tcpdump -n -e -ttt -r /var/log/pflog
137.Ed
138.Pp
139Display the logs in real time (this does not interfere with the
140operation of
141.Nm ) :
142.Bd -literal -offset indent
143# tcpdump -n -e -ttt -i pflog0
144.Ed
145.Pp
146Tcpdump has been extended to be able to filter on the pfloghdr
147structure defined in
148.Aq Ar net/if_pflog.h .
149Tcpdump can restrict the output
150to packets logged on a specified interface, a rule number, a reason,
151a direction, an IP family or an action.
152.Pp
153.Bl -tag -width "reason match " -compact
154.It ip
155Address family equals IPv4.
156.It ip6
157Address family equals IPv6.
158.It ifname kue0
159Interface name equals "kue0".
160.It on kue0
161Interface name equals "kue0".
162.It rulenum 10
163Rule number equals 10.
164.It reason match
165Reason equals match.
166Also accepts "bad-offset", "fragment", "bad-timestamp", "short",
167"normalize" and "memory".
168.It action pass
169Action equals pass.
170Also accepts "block".
171.It inbound
172The direction was inbound.
173.It outbound
174The direction was outbound.
175.El
--- 11 unchanged lines hidden (view full) ---
187.Xr pf.conf 5 ,
188.Xr newsyslog 8
189.Sh HISTORY
190The
191.Nm
192command appeared in
193.Ox 3.0 .
194.Sh AUTHORS
195Can Erkin Acar