I have PF configured and working with rule sets that are logged.
Where is PF logging to? How do I check these logs? How do I configure them?
Add a comment
|
3 Answers
Packet filter doesn't log on any file. It does log on a network interface named pflog0 (a special device in Unix-lang), see
man pf.conf
You turn on this interface with:
/usr/bin/sudo ifconfig pflog0 create
You suppress it with:
/usr/bin/sudo ifconfig pflog0 destroy
You can follow what does packet filter logs on this interface with
tcpdump or wireshark.
Ex. :
/usr/bin/sudo tcpdump -i pflog0
If you want to go any further with PF and without writing your own configuration files, I highly recommand to test Murus.
Generally the PF log file would be stored in:
/var/log/
to tcpdump for example you might do:
tcpdump -n -e -ttt -i pflog1
for more info do:
man pflog
-
I checked var log not there. I don't have that interface I am comfortable with that tcpdump command ; I do have a dev pf I'm not sure if that's related ; Nov 17, 2013 at 2:14
-
-
-
I dear god more bash script bombs hey you shady fellow I need cs13 do you have a copy Nov 17, 2013 at 4:21
For macOS 10.12 the tcpdump command for the logs appears to be broken. Wireshark can be used or Pfloggerd see https://discussions.apple.com/thread/7905793
