On Thu, Jul 31, 2003 at 12:42:10AM +0200, Mark Bojara wrote: > fxp0 is the uplink interface and xl0 is the interface that the vlan is > connected too. If i tcpdump xl0 I can see traffic from all the vlan's on > it.
pf and BPF aren't in the same place in packet flow. tcpdump gets packets much earlier on, and sees stuff that pf never gets, such as arp traffic, etc. This is why Daniel suggested testing with a 'pass log all' rule to see wheich interface pf was handling the traffic on, rather than looking with tcpdump. -Ryan
