PFLOG(4)

💅 PFLOG(4) — like, the packet filter logging interface, bestie ✨

pflog — the Kernel Interfaces Manual's own little icon, fr fr 🎀

---

✨ NAME ✨

pflog — the packet filter logging interface, and yes she's that girl 💅

---

🦋 SYNOPSIS 🦋

device pflog

---

👑 DESCRIPTION 👑

Okay so picture this: the pflog interface is a device that makes visible every single packet the packet filter, pf(4), logs. Like, every packet gets its moment in the spotlight, no cap 👀. You can watch logged packets in real time — literally just invoke tcpdump(1) on the pflog interface — or you can stash them to disk using pflogd(8). Both are valid, both slay 🫶.

The pflog0 interface gets created when the pflog module is loaded. Want more instances? Bestie, you can absolutely make more with ifconfig(8) — collect them like stickers 🌸. And the pflog module loads itself automatically if both pf(4) and pflogd(8) are enabled. Self-sufficient queen behavior 💜.

Every packet you retrieve on this interface comes with a header attached, and that header is exactly PFLOG_HDRLEN bytes long. What's in it? Only the address family, interface name, rule number, reason, action, and direction of the packet that got logged. It's giving ✨receipts✨. This structure lives in ⟨net/if_pflog.h⟩ and looks like this:

struct pfloghdr {
        u_int8_t        length;
        sa_family_t     af;
        u_int8_t        action;
        u_int8_t        reason;
        char            ifname[IFNAMSIZ];
        char            ruleset[PF_RULESET_NAME_SIZE];
        u_int32_t       rulenr;
        u_int32_t       subrulenr;
        uid_t           uid;
        pid_t           pid;
        uid_t           rule_uid;
        pid_t           rule_pid;
        u_int8_t        dir;
        u_int8_t        pad[3];
        u_int32_t       ridentifier;
};

---

🌈 EXAMPLES 🌈

Okay, main character demo time — create a pflog interface and monitor every packet logged on it:

# ifconfig pflog create
pflog1
# ifconfig pflog1 up
# tcpdump -n -e -ttt -i pflog1

Ate. No notes. 🔥

---

💖 SEE ALSO 💖

tcpdump(1), inet(4), inet6(4), netintro(4), pf(4), ifconfig(8), pflogd(8)

---

🎀 HISTORY 🎀

The pflog device first appeared in OpenBSD 3.0. A legend since day one 👑.

---

💀 BUGS 💀

Heads up bestie: FreeBSD does not set a process id in the pid field in pfloghdr. So like… that field's just sitting there empty. Not her fault, but you should know 🙈.

---

That's the whole page, bestie 🧚 — signed, sealed, and delivered straight from the Debian crew, dated October 29, 2021. Go forth and log responsibly 💖✨