3 ms·
tcpdump can see traffic fine without an IP on an interface (how much traffic the interface has traffic without one is another question) pflog interface is not
by AdamJacobMuller 3y ago
tcpdump can see traffic fine without an IP on an interface (how much traffic the interface has traffic without one is another question)
pflog interface is not a "real" interface, there's no point in putting an IP address on it
- mannyv 3y agoOh, pflog interfaces are a special device that's known by tcpdump. Interesting.
- AdamJacobMuller 3y agoYes, kinda. I'm not sure if tcpdump knows exactly that it's a pflog interface but tcpdump knows how to decode the wire format which traverses the pflog interface. It's a bit of a weird thing, using a network device for logging information like this, but it works.