---
name: "bpflogd"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/bpflogd"
---

# bpflogd(8)

Berkeley Packet Filter logging daemon

## NAME

**bpflogd** – Berkeley Packet Filter logging daemon

## SYNOPSIS

**bpflogd** \[**-dPp**\] \[**-F** *filterfile*\] \[**-s** *snaplen*\] \[**-u** *user*\] \[**-w** *waitms*\] \[**-y** *datalinktype*\] **-f** *filename* **-i** *interface* \[*expression* *...*\]

## DESCRIPTION

**bpflogd** is a daemon which captures packets using [bpf(4)](/bpf/4.md) and writes the packets to a logfile in [tcpdump(8)](/tcpdump/8.md) binary format. These logs can be reviewed later using the **-r** option of [tcpdump(8)](/tcpdump/8.md).

When starting up, **bpflogd** drops privileges before opening its log file. After receiving a SIGHUP signal it will write any pending packets to the log file, close it, and then open it again, permitting [newsyslog(8)](/newsyslog/8.md) to rotate logfiles automatically. If the log file contains data after being opened, the PCAP header is checked before new logs are appended to the existing file.

The options are as follows:

- **-d**

  Debugging mode. **bpflogd** does not daemonise and logs to the terminal.

- **-f** *filename*

  Log output filename. The file must already exist, and be readable and writable by the \_pflogd user.

- **-F** *filterfile*

  Specify a file containing a filter expression as per [pcap-filter(5)](/pcap-filter/5.md).

- **-i** *interface*

  Specifies the interface to capture packets on using [bpf(4)](/bpf/4.md). This can be specified multiple times to capture packets from multiple interfaces, but all the interfaces must support the same datalink type.

- **-P**

  Put the interfaces into promiscuous mode.

- **-p**

  Do not put the interfaces into promiscuous mode. This is the default.

- **-s** *snaplen*

  Capture at most the first *snaplen* bytes of data from each packet. By default **bpflogd** captures whole packets.

- **-u** *user*

  Drop privileges to *user*. By default **bpflogd** drops privileges to the \_pflogd user.

- **-w** *waitms*

  Specify the maximum amount of time in milliseconds between when a packet is captured and when it will be written to the log file. The default *waitms* value is 2000 milliseconds.

- **-y** *datalinktype*

  Specify the datalink type when capturing packets. If this is not specified then the default datalink type on the first interface is used.

- *expression*

  Specify a filter expression for matching packets as per [pcap-filter(5)](/pcap-filter/5.md).

A filter expression may only be specified by a file with *-F* or as arguments on the command line; specifying both is unsupported. If a filter is not provided then all packets are captured.

## SEE ALSO

[pcap\_open\_live(3)](/pcap_open_live/3.md), [pcap-filter(5)](/pcap-filter/5.md), [newsyslog(8)](/newsyslog/8.md), [tcpdump(8)](/tcpdump/8.md)

## HISTORY

The **bpflogd** command appeared in OpenBSD 7.8.