View Single Post
  #2   (View Single Post)  
Old 24th September 2008
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,983
Default

It's been years since I have used Snort on OpenBSD, so I cannot provide up-to-date knowledge... but from fading memory, it seems that you should be able to analyze logged information from the pflog(4) device or from pflogd(8) logfiles.

To log traffic, be sure to add the log option to each filter rule you are interested in, either passed or blocked.

As to why blocked NIC traffic is blocked from Snort? My best guess: Snort is a userland application; PF is part of the kernel. PF prevents userland processes from seeing blocked traffic.

Last edited by jggimi; 24th September 2008 at 11:05 PM.
Reply With Quote