4 ms·
Is there something you could add to the reproduce case to workaround this, like plumb/pull up after pfrules are loaded as you mentioned?
by MuffinFlavored 3y ago
Is there something you could add to the reproduce case to workaround this, like plumb/pull up after pfrules are loaded as you mentioned?
- mannyv 3y agoOn Ventura 13.5.2 ifconfig create creates the interface UP: bash-3.2# ifconfig pflog1 create bash-3.2# ifconfig -a pflog1: flags=1<UP> mtu 33072 But I don't think tcpdump will see anything because there's no IP associated with that interface. On some devices (Broadcom) the OS will just dump stuff out of an interface, but I'm not sure what MacOS does in this case. I presume this was tested to work on 13.5.2?
- AdamJacobMuller 3y agotcpdump can see traffic fine without an IP on an interface (how much traffic the interface has traffic without one is another question) pflog interface is not a "real" interface, there's no point in putting an IP address on it
- mannyv 3y agoOh, pflog interfaces are a special device that's known by tcpdump. Interesting.
- AdamJacobMuller 3y agoYes, kinda. I'm not sure if tcpdump knows exactly that it's a pflog interface but tcpdump knows how to decode the wire format which traverses the pflog interface. It's a bit of a weird thing, using a network device for logging information like this, but it works.