--- Quoting Uwe Dippel on 2006/11/19 at 10:11 +0800: > On Sat, 18 Nov 2006 21:07:57 +0100, Joachim Schipper wrote: > > > On second thought, are you certain pflogd *should* be listening on bpf0? > > No; but it never did before (despite of the reboots) and I didn't make it > to do so.
pflogd uses the pcap library to listen on pflog0. pcap uses bpf devices to do its job. > > And not on, say, pflog0? It's a privilige separated daemon running as > > `_pflogd', so that it can't open the above files does make sense... pflog0 is opened with pcap before privileges are dropped otherwise it would never work. > How *would* I make it listen on /dev/xxxxx, by the way ? (Except by > changing the source, that is ?) you don't. if i remember the original issue correctly, look at your /dev/bpf* devices. for some reason pflogd (via pcap) is unable to open bpf0. perhaps a 'cd /dev; ./MAKEDEV bpf' is needed. .joel
