On 2014/02/17 13:36, Philipp wrote: > Am 17.02.2014 13:11 schrieb Henning Brauer: > >how do you emit such a maessage in pcap? as payload with a dummy > >packet header? (NOOOOOOOOOOOO!!!!!!!!!!) > > pf is taking action without telling anyone - and that's not nice. > > There *are* other log() entries in pf.c already so I wonder how the initial > comment about 'slow via serial console' would qualify.
But it is telling people, via the counters. The log entries which are at risk of being printed frequently are "hidden" by default, i.e. put behind LOG_DEBUG or similar. It seems to me that increasing the "state-limit" counter is just as useful as adding a new LOG_DEBUG for this.. As for pflog, surely somebody who knows how to look at pflog also knows to look at pfctl -si?
