3

I have PF configured and working with rule sets that are logged.

Where is PF logging to? How do I check these logs? How do I configure them?

3 Answers 3

5

Packet filter doesn't log on any file. It does log on a network interface named pflog0 (a special device in Unix-lang), see

man pf.conf

You turn on this interface with:

/usr/bin/sudo ifconfig pflog0 create

You suppress it with:

/usr/bin/sudo ifconfig pflog0 destroy

You can follow what does packet filter logs on this interface with tcpdump or wireshark.

Ex. :

/usr/bin/sudo tcpdump -i pflog0

If you want to go any further with PF and without writing your own configuration files, I highly recommand to test Murus.

0

Generally the PF log file would be stored in:

/var/log/

to tcpdump for example you might do:

tcpdump -n -e -ttt -i pflog1

for more info do:

man pflog
4
  • I checked var log not there. I don't have that interface I am comfortable with that tcpdump command ; I do have a dev pf I'm not sure if that's related ; Nov 17, 2013 at 2:14
  • No wait damit it's osx 10.9 I forgot something I knew it Nov 17, 2013 at 2:22
  • BTW — you might be interested in this nice/simple frontend for PFLists
    – l'L'l
    Nov 17, 2013 at 3:45
  • I dear god more bash script bombs hey you shady fellow I need cs13 do you have a copy Nov 17, 2013 at 4:21
0

For macOS 10.12 the tcpdump command for the logs appears to be broken. Wireshark can be used or Pfloggerd see https://discussions.apple.com/thread/7905793

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .