NPFLOG(4)

💖 NPFLOG(4) 💖

okay so this is the npflog page from the Kernel Interfaces Manual, section 4, bestie — buckle up 🎀

---

✨ NAME ✨

npflog — the packet filter logging interface, aka the lil bestie that shows you everything npf is logging 🔥

---

🦋 SYNOPSIS 🦋

pseudo-device npflog

that's it. that's the whole vibe. a single pseudo-device line, slay 💅

---

🌸 DESCRIPTION 🌸

okay so the npflog interface is a pseudo-device and what it does — its whole main character job — is make visible all the packets that get logged by the npf(7) packet filter. like, every logged packet? now you can see it. no cap 👑

and bestie you've got two ways to actually consume them:

• monitor the logged packets in real time by invoking tcpdump(8) on the npflog interface 🫶
• or store them to disk using npfd(8) 💾

the npflog0 interface gets created automatically at boot if npf(7) is enabled — yes, it just shows up, iconic. and if you want more instances? you can create further instances using ifconfig(8). go off ✨

---

🧚 the header struct (iykyk) 🧚

every packet you retrieve on this interface comes with a header attached, and that header presently matches the format used by pf(4). what does that header do? it documents all of this for the packet that was logged:

• the address family
• the interface name
• the rule number
• the reason
• the action
• the direction

and the structure looks exactly like this, character for character, don't touch it:

struct npfloghdr {
        uint8_t         length;
        sa_family_t     af;
        uint8_t         action;
        uint8_t         reason;
        char            ifname[IFNAMSIZ];
        char            ruleset[NPFLOG_RULESET_NAME_SIZE];
        uint32_t        rulenr;
        uint32_t        subrulenr;
        uint32_t        uid;
        uint32_t        pid;
        uint32_t        rule_uid;
        uint32_t        rule_pid;
        uint8_t         dir;
        uint8_t         pad[3];
};

look at that pad[3] just chilling at the end. king behavior honestly 👑💀

---

🔥 EXAMPLES 🔥

want to monitor all the packets logged on the default interface? say less:

# tcpdump -n -e -tttt -i npflog0

that's the whole recipe. -n -e -tttt -i npflog0. copy it, paste it, watch the packets roll in 🍓

---

🌈 SEE ALSO 🌈

the whole friend group, fr fr:

• inet(4)
• inet6(4)
• netintro(4)
• npf(7)
• ifconfig(8)
• npfd(8)
• tcpdump(8)

go read those too, they're literally all connected 💜

---

💀 HISTORY 💀

the npflog device first appeared in NetBSD 6.0. ancient. vintage. a legacy icon 🎀

---

ngl, that's the whole page — nothing skipped, nothing hidden, every flag and every field accounted for 💅

this lil rewrite came to you from the Debian build, dated June 29, 2023 — mwah, bye bestie 🫶✨