From nobody Wed Dec 28 14:39:30 2022
X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NhvLC6HjXz1LqrS
	for <freebsd-current@mlmmj.nyi.freebsd.org>; Wed, 28 Dec 2022 14:39:31 +0000 (UTC)
	(envelope-from mack@macktronics.com)
Received: from mail.macktronics.com (coco.macktronics.com [209.181.253.65])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4NhvLC5cZDz3PTh
	for <freebsd-current@freebsd.org>; Wed, 28 Dec 2022 14:39:31 +0000 (UTC)
	(envelope-from mack@macktronics.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: from olive.macktronics.com (unknown [209.181.253.67])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.macktronics.com (Postfix) with ESMTPS id D5B693291;
	Wed, 28 Dec 2022 08:39:30 -0600 (CST)
Date: Wed, 28 Dec 2022 08:39:30 -0600 (CST)
From: Dan Mack <mack@macktronics.com>
To: Sami Halabi <sodynet1@gmail.com>
cc: FreeBSD Current <freebsd-current@freebsd.org>
Subject: Re: native recording of all network connections on freebsd
In-Reply-To: <CAEW+ogbJrKJR+QJ2hmzvAOTaX6YoftMT0GrEcqEOhwAMddczbg@mail.gmail.com>
Message-ID: <134dcd9-30d-b2d9-2732-992cf2310d8@macktronics.com>
References: <b2ea51ee-3944-b8d7-e0a8-8e4f16ebb8f@macktronics.com> <CAEW+ogbJrKJR+QJ2hmzvAOTaX6YoftMT0GrEcqEOhwAMddczbg@mail.gmail.com>
List-Id: Discussions about the use of FreeBSD-current <freebsd-current.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-current
List-Help: <mailto:freebsd-current+help@freebsd.org>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Subscribe: <mailto:freebsd-current+subscribe@freebsd.org>
List-Unsubscribe: <mailto:freebsd-current+unsubscribe@freebsd.org>
Sender: owner-freebsd-current@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
X-Rspamd-Queue-Id: 4NhvLC5cZDz3PTh
X-Spamd-Bar: ----
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:209, ipnet:209.181.252.0/23, country:US]
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-ThisMailContainsUnwantedMimeParts: N


Thank you, Oh how dumb I am - I'll just have pf do it using 'log all'.

Dan

On Wed, 28 Dec 2022, Sami Halabi wrote:

> using firewall ike ipfw with rule to log any to any would be a start.. for
> advanced use, stateful fw so You can log start of connections
>
> ?????? ??? ??, 28 ????? 2022, 16:21, ??? Dan Mack ?<mack@macktronics.com>:
>
>>
>> I'm wondering if anyone can help point me at a good way to continously
>> capture every inbound and outbound connection made to a freebsd system.
>> I'd prefer a way that is native in base if possible.   I don't really want
>> to record all the packets, just the src:dest:rport:dport stats.
>>
>> Happy to RTFM as well,
>>
>> Dan
>>
>>
>