---
name: "pflog"
section: "4"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["linux", "freebsd", "openbsd"]
url: "https://new.carta.tech/pflog"
---

# pflog(4)

packet filter logging interface

## NAME

**pflog** – packet filter logging interface

## SYNOPSIS

**pseudo-device pflog**

## DESCRIPTION

The **pflog** interface is a pseudo-device which makes visible all packets logged by the packet filter, [pf(4)](/pf/4.md). Logged packets can easily be monitored in real time by invoking [tcpdump(8)](/tcpdump/8.md) on the **pflog** interface, or stored to disk using [pflogd(8)](/pflogd/8.md).

The pflog0 interface is created automatically at boot if both [pf(4)](/pf/4.md) and [pflogd(8)](/pflogd/8.md) are enabled; further instances can be created using [ifconfig(8)](/ifconfig/8.md).

Each packet retrieved on this interface has a header associated with it of length PFLOG\_HDRLEN. This header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged. This structure, defined in ⟨net/if\_pflog.h⟩ looks like

```
struct pfloghdr {
	u_int8_t	length;
	sa_family_t	af;
	u_int8_t	action;
	u_int8_t	reason;
	char		ifname[IFNAMSIZ];
	char		ruleset[PFLOG_RULESET_NAME_SIZE];
	u_int32_t	rulenr;
	u_int32_t	subrulenr;
	uid_t		uid;
	pid_t		pid;
	uid_t		rule_uid;
	pid_t		rule_pid;
	u_int8_t	dir;
	u_int8_t	rewritten;
	sa_family_t	naf;
	u_int8_t	pad[1];
	struct pf_addr	saddr;
	struct pf_addr	daddr;
	u_int16_t	sport;
	u_int16_t	dport;
};
```

## EXAMPLES

Create a **pflog** interface and monitor all packets logged on it:

```
# ifconfig pflog1 up
# tcpdump -n -e -ttt -i pflog1
```

## SEE ALSO

[inet(4)](/inet/4.md), [inet6(4)](/inet6/4.md), [netintro(4)](/netintro/4.md), [pf(4)](/pf/4.md), [ifconfig(8)](/ifconfig/8.md), [pflogd(8)](/pflogd/8.md), [tcpdump(8)](/tcpdump/8.md)

## HISTORY

The **pflog** device first appeared in OpenBSD 3.0.