fwanalog on FreeBSD & PF

[Rudi Kramer]

Good Morning,

I'm busy trying to setup fwanalog on FreeBSD 6.1 using PF but I receive the following error message:

tcpdump: bad dump file format

<Snipet from fwanalog.out/analog.err>

C: 846592 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > 196.2.148.63.137: UDP, length 50
C:                         *
C: 594470 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > 196.2.148.63.137: UDP, length 50
C:                         *
C: 343338 rule 0/0(match): block in on fxp0: 196.2.148.19.137 > 196.2.148.63.137: UDP, length 50
C:                         *
C: 558290 rule 0/0(match): block in on fxp0: 196.2.148.12.138 > 196.2.148.63.138: UDP, length 201
C:                         *
analog: Warning L: Large number of corrupt lines in logfile
  /root/fwanalog.out/fwanalog.all.log: turn debugging on or try different
  LOGFORMAT
  (For help on all errors and warnings, see docs/errors.html)
    Current logfile format:
      %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%j" %t %v\n


It seems like the tcpdump format used in FreebSD differs from openBSD. 

Does anyone have a working config that I can try?
  
Thanks
Rudi