view OpenBSD PF activity in real time

baronobeefdip · 12-24-2011, 05:37 PM

i want to know if it's possible to view OpenBSD's PF activity on screen. i want to be able to view the firewall's activity in real-time as in i want to be able to view which packets were passed and which ones were dropped (or one at a time in case i only want to view which packets were dropped) i want to know how to do this in FreeBSD since it's my BSD distro of choice

coolsg5636 · 12-25-2011, 11:38 AM

Hello,

Check this link out..you might find it useful.

http://www.pfsense.org/index.php?opt...d=40&Itemid=43

anomie · 12-25-2011, 09:26 PM

For real-time display, I recommend the sysutils/pftop port.

gezley · 12-26-2011, 09:02 PM

Code:

tcpdump -n -e -ttt -i pflog0

Your rules of course need to have the log option included for the interface you want to watch. tcpdump can be filtered in many ways to restrict the realtime display further:

Code:

tcpdump -n -e -ttt -i pflog0 port 22

bren.smith · 12-28-2011, 11:10 AM

Check out the man pages for both pfctl or the additional package pftop.