Oh, great! Thank you!
________________________________ From: Matthew Seaman <m.sea...@infracaninophile.co.uk> To: Dánielisz László <laszlo_daniel...@yahoo.com> Cc: freebsd-questions@freebsd.org Sent: Mon, October 19, 2009 8:33:37 PM Subject: Re: pf+time stamp Dánielisz László wrote: > Hello, > > Do you have any idea how to add and read time stamp of pf/pf.log? > > Thank you! > Laci Do you mean /var/log/pflog ? Which is the default location where a record of logged packets ends up if you run pflogd(8). That's actually a pcap (packet capture) file, and you can read it using tcpdump: # tcpdump -r /var/log/pflog Each packet is recorded with a high resolution timestamp that tcpdump will display for you -- like this naughty chap suffering the consequences of trying to brute-force my ssh daemon just before 1:00pm today: 12:52:44.891373 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: . ack 2991958242 win 1460 <nop,nop,timestamp 2 9319378 1107347817,[|tcp]> 12:52:45.516283 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209319535 1107347817> 12:52:48.387822 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209320253 1107347817> 12:52:54.131863 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209321689 1107347817> 12:52:57.113810 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: . ack 1 win 1460 <nop,nop,timestamp 209322434 1107347817,[|tcp]> 12:53:05.620251 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209324561 1107347817> 12:53:28.597524 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209330305 1107347817> 12:54:14.550822 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209341793 1107347817> 12:55:46.457353 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209364769 1107347817> 13:00:15.032146 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: R 1230911050:1230911050(0) win 1460 Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"