2 ms·
Question: if pflog1 isn't created, does pf work as expected? Since tcpdump presumably isn't logging anything going out of pflog1, it implies that the data isn'
by mannyv 3y ago
Question: if pflog1 isn't created, does pf work as expected?
Since tcpdump presumably isn't logging anything going out of pflog1, it implies that the data isn't being sent to pflog1. That implies that it's something upstream from there.
Was pflog1 plumbed and/or pulled up? Back in the day you used to have to plumb and pull up an interface manually. Does MacOS do that for you?
Granted, isolating this isn't the bug reporter's job. But at some point the engineer will be asking these questions, so you might as well answer them.
- MuffinFlavored 3y agoIs there something you could add to the reproduce case to workaround this, like plumb/pull up after pfrules are loaded as you mentioned?
- mannyv 3y agoOn Ventura 13.5.2 ifconfig create creates the interface UP: bash-3.2# ifconfig pflog1 create bash-3.2# ifconfig -a pflog1: flags=1<UP> mtu 33072 But I don't think tcpdump will see anything because there's no IP associated with that interface. On some devices (Broadcom) the OS will just dump stuff out of an interface, but I'm not sure what MacOS does in this case. I presume this was tested to work on 13.5.2?
- AdamJacobMuller 3y agotcpdump can see traffic fine without an IP on an interface (how much traffic the interface has traffic without one is another question) pflog interface is not a "real" interface, there's no point in putting an IP address on it
- mannyv 3y agoOh, pflog interfaces are a special device that's known by tcpdump. Interesting.
- AdamJacobMuller 3y agoYes, kinda. I'm not sure if tcpdump knows exactly that it's a pflog interface but tcpdump knows how to decode the wire format which traverses the pflog interface. It's a bit of a weird thing, using a network device for logging information like this, but it works.
- mannyv 3y agoOh, you should also do a: ifconfig pflog1 destroy afterwards to whack that extra interface.