Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# Matching log data to your rule set

`pflog` log data include rule number matched in the loaded rule set

    $ sudo tcpdump -nettti pflog0
    tcpdump: WARNING: pflog0: no IPv4 address assigned
    tcpdump: listening on pflog0, link-type PFLOG
    Sep 13 15:26:52.122002 rule 17/(match) pass in on epic0: 91.143.126.48.46618 > 194.54.103.65.22: [|tcp] (DF)
    Sep 13 15:28:02.771442 rule 12/(match) pass in on epic0: 194.54.107.19.8025 > 194.54.107.18.8025: udp 50
    Sep 13 15:28:02.773958 rule 10/(match) pass in on epic0: 194.54.107.19.8025 > 194.54.103.65.8025: udp 50
    Sep 13 15:29:27.882888 rule 10/(match) pass in on epic0: 194.54.107.19.29774 > 194.54.103.65.53:[|domain]
    Sep 13 15:29:28.394320 rule 12/(match) pass in on epic0: 194.54.107.19.29774 > 194.54.107.18.53:[|domain]

match to `pfctl -vvsr` output

    $ sudo pfctl -vvsr
    @0 scrub in all fragment reassemble
      [ Evaluations: 6116699   Packets: 3069556   Bytes: 646214426   States: 0     ]
      [ Inserted: uid 0 pid 2006 ]
    @0 block return log all
      [ Evaluations: 102723    Packets: 2539      Bytes: 269448      States: 0     ]
      [ Inserted: uid 0 pid 2006 ]
    @1 block return log quick from <bruteforce:1> to any
      [ Evaluations: 102723    Packets: 40        Bytes: 2384        States: 0     ]
      [ Inserted: uid 0 pid 2006 ]
    @2 anchor "ftp-proxy/*" all
      [ Evaluations: 102683    Packets: 28044     Bytes: 22617668    States: 0     ]
      [ Inserted: uid 0 pid 2006 ]