---
name: "pflog"
section: "4"
platform: "linux"
package: "freebsd-manpages"
version: "6.0-5"
release: "Debian 4.0 (Etch)"
platforms: ["linux", "freebsd", "openbsd"]
url: "https://new.carta.tech/pflog"
---

# pflog(4)

packet filter logging interface

## NAME

**pflog** – packet filter logging interface

## SYNOPSIS

**device pflog**

## DESCRIPTION

The **pflog** interface is a pseudo-device which makes visible all packets logged by the packet filter, [pf(4)](/pf/4.md). Logged packets can easily be monitored in real time by invoking [tcpdump(1)](/tcpdump/1.md) on the **pflog** interface, or stored to disk using [pflogd(8)](/pflogd/8.md).

Each packet retrieved on this interface has a header associated with it of length PFLOG\_HDRLEN. This header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged. This structure, defined in ⟨*net/if\_pflog.h*⟩ looks like

```
struct pfloghdr {
	u_int8_t	length;
	sa_family_t	af;
	u_int8_t	action;
	u_int8_t	reason;
	char		ifname[IFNAMSIZ];
	char		ruleset[PF_RULESET_NAME_SIZE];
	u_int32_t	rulenr;
	u_int32_t	subrulenr;
	u_int8_t	dir;
	u_int8_t	pad[3];
};
```

## EXAMPLES

```
# ifconfig pflog0 up
# tcpdump -n -e -ttt -i pflog0
```

## SEE ALSO

[tcpdump(1)](/tcpdump/1.md) [inet(4)](/inet/4.md), [inet6(4)](/inet6/4.md), [netintro(4)](/netintro/4.md), [pf(4)](/pf/4.md), [ifconfig(8)](/ifconfig/8.md), [pflogd(8)](/pflogd/8.md)

## HISTORY

The **pflog** device first appeared in OpenBSD 3.0.