Thread: Identify rules to behaviour
View Single Post
  #2   (View Single Post)  
Old 21st March 2012
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
  
Join Date: May 2008
Location: USA
Posts: 7,983
Default
  1. Log both your pass rules as well as your block rules.
  2. # tcpdump -neti pflog0 host ip.address.of.interest

    You will see block/pass rules applied to initial state packets for that IP address. If PF rules do not seem to point to a problem source, then use tcpdump(8) on the NIC:
  3. # tcpdump -neti nic host ip.address.of.interest
Reply With Quote