ipfw2 logs to bpf (was Re: cvs commit: src/sbin/ipfw ipfw2.c...)

[Luigi Rizzo]

On Tue, Dec 13, 2005 at 03:48:59PM +0100, Poul-Henning Kamp wrote:
> In message <20051213061503.A10373 at xorpc.icir.org>, Luigi Rizzo writes:
> 
> >talking about ipfw2, a couple of years ago i posted some code for 4.x
> >to let ipfw2 "log" packets to a pseudo interface called /dev/ipfw0 so
> >that people in need of detailed logging could just get it from
> >there through tcpdump or whatever.
> 
> Isn't it easier to use ipfwpcap(8) and a divert socket ?

well apart that i just learned about it from this email and couldn't
find a manpage, they are similar in spirit but they don't seem to
do exactly the same thing:

- 'log' is an option that you can set on any ipfw rule, independently
  from the action;
- ipfwpcap only works on divert or tee rules (i read in the code
  that tee is broken but assume it can be fixed so the performance
  objection for the -r option will not matter, eventually).

so i believe the /dev/ipfw trick is a bit more flexible

cheers
luigi

> -- 
> Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
> phk at FreeBSD.ORG         | TCP/IP since RFC 956
> FreeBSD committer       | BSD since 4.3-tahoe    
> Never attribute to malice what can adequately be explained by incompetence.