---
name: "pflog"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd", "openbsd"]
url: "https://new.carta.tech/pflog"
---

# pflog(4)

packet filter logging BPF tap

## NAME

**pflog** – packet filter logging BPF tap

## SYNOPSIS

**device pflog**

## DESCRIPTION

The **pflog** is a BPF tap which makes visible all packets logged by the packet filter, [pf(4)](/pf/4.md). Logged packets can easily be monitored in real time by invoking [tcpdump(1)](/tcpdump/1.md) on the **pflog** BPF tap, or stored to disk using [pflogd(8)](/pflogd/8.md).

The pflog0 BPF tap is created when the **pflog** module is loaded; further instances can be created using [ifconfig(8)](/ifconfig/8.md). The **pflog** module is loaded automatically if both [pf(4)](/pf/4.md) and [pflogd(8)](/pflogd/8.md) are enabled.

Each packet retrieved on this BPF tap has a header associated with it of length PFLOG\_HDRLEN. This header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged. This structure, defined in ⟨*net/if\_pflog.h*⟩ looks like

```
struct pfloghdr {
	u_int8_t	length;
	sa_family_t	af;
	u_int8_t	action;
	u_int8_t	reason;
	char		ifname[IFNAMSIZ];
	char		ruleset[PF_RULESET_NAME_SIZE];
	u_int32_t	rulenr;
	u_int32_t	subrulenr;
	uid_t		uid;
	pid_t		pid;
	uid_t		rule_uid;
	pid_t		rule_pid;
	u_int8_t	dir;
	u_int8_t	pad[3];
	u_int32_t	ridentifier;
};
```

The number of pflog devices can be configured with the *net.pflog.if\_count* sysctl.

## EXAMPLES

Monitor all packets logged on pflog0:

```
# tcpdump -n -e -ttt -i pflog0
```

## SEE ALSO

[tcpdump(1)](/tcpdump/1.md), [inet(4)](/inet/4.md), [inet6(4)](/inet6/4.md), [netintro(4)](/netintro/4.md), [pf(4)](/pf/4.md), [ifconfig(8)](/ifconfig/8.md), [pflogd(8)](/pflogd/8.md)

## HISTORY

The **pflog** device first appeared in OpenBSD 3.0.

## BUGS

FreeBSD does not set a process id in the *pid* field in pfloghdr.