PFLOG(4)

💖 PFLOG(4) — the packet filter logging interface, bestie edition 💖

Kernel Interfaces Manual ✨ so like, this is pflog, and she's serving main character energy in the kernel interfaces department 🎀

---

🌸 NAME 🌸

pflog — the packet filter logging interface, aka the lil interface that spills all the tea your firewall logs 💅

---

🦋 SYNOPSIS 🦋

device pflog

---

✨ DESCRIPTION ✨

okay so listen 👂 the pflog interface is literally a device that makes visible all the packets logged by the packet filter, pf(4) 🔥 like, every single packet pf decided to write down? yeah, it shows up here. no cap.

and the way you can just… watch them in real time?? obsessed. you invoke tcpdump(1) on the pflog interface and boom 💥 you're monitoring logged packets live. or if you want them kept forever, you store them to disk using pflogd(8) 🍓

so the pflog0 interface? she gets created automatically at boot if both pf(4) and pflogd(8) are enabled 🫶 iconic behaviour honestly. and if you want more of them — further instances — you can create them using ifconfig(8) 🌈

now here's the part that's giving very much "pay attention bestie" 📝:

every packet retrieved on this interface has a header associated with it, and that header has length PFLOG_HDRLEN. this header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged 👑

the structure is defined in ⟨net/if_pflog.h⟩ and it looks like this:

struct pfloghdr {
        u_int8_t        length;
        sa_family_t     af;
        u_int8_t        action;
        u_int8_t        reason;
        char            ifname[IFNAMSIZ];
        char            ruleset[PF_RULESET_NAME_SIZE];
        u_int32_t       rulenr;
        u_int32_t       subrulenr;
        uid_t           uid;
        pid_t           pid;
        uid_t           rule_uid;
        pid_t           rule_pid;
        u_int8_t        dir;
        u_int8_t        pad[3];
};

look at her. structured. flawless. no notes 💅✨

---

💜 EXAMPLES 💜

want to create a pflog interface and monitor all packets logged on it? say less, bestie:

# ifconfig pflog1 up
# tcpdump -n -e -ttt -i pflog1

literally two lines and you're watching the whole situation unfold in real time 😭🔥

---

🎀 SEE ALSO 🎀

• tcpdump(1)
• inet(4)
• inet6(4)
• netintro(4)
• pf(4)
• ifconfig(8)
• pflogd(8)

iykyk 💖

---

👑 HISTORY 👑

the pflog device first appeared in OpenBSD 3.0 🌈 a legend from the very beginning, fr fr.

---

and that's the whole page bestie, mwah 💋 this cutie was brought to you by Debian, dated May 31, 2007 — yeah she's vintage but she still slays 🎀💖✨