---
name: "pflog"
section: "4freebsd"
platform: "linux"
package: "freebsd-manpages"
version: "12.2-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pflog/4freebsd"
---

# pflog(4freebsd)

packet filter logging interface

## NAME

**pflog** – packet filter logging interface

## SYNOPSIS

**device pflog**

## DESCRIPTION

The **pflog** interface is a device which makes visible all packets logged by the packet filter, [pf(4)](/pf/4.md). Logged packets can easily be monitored in real time by invoking [tcpdump(1)](/tcpdump/1.md) on the **pflog** interface, or stored to disk using [pflogd(8)](/pflogd/8.md).

The pflog0 interface is created automatically at boot if both [pf(4)](/pf/4.md) and [pflogd(8)](/pflogd/8.md) are enabled; further instances can be created using [ifconfig(8)](/ifconfig/8.md).

Each packet retrieved on this interface has a header associated with it of length PFLOG\_HDRLEN. This header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged. This structure, defined in ⟨*net/if\_pflog.h*⟩ looks like

```
struct pfloghdr {
	u_int8_t	length;
	sa_family_t	af;
	u_int8_t	action;
	u_int8_t	reason;
	char		ifname[IFNAMSIZ];
	char		ruleset[PF_RULESET_NAME_SIZE];
	u_int32_t	rulenr;
	u_int32_t	subrulenr;
	uid_t		uid;
	pid_t		pid;
	uid_t		rule_uid;
	pid_t		rule_pid;
	u_int8_t	dir;
	u_int8_t	pad[3];
};
```

## EXAMPLES

Create a **pflog** interface and monitor all packets logged on it:

```
# ifconfig pflog1 up
# tcpdump -n -e -ttt -i pflog1
```

## SEE ALSO

[tcpdump(1)](/tcpdump/1.md), [inet(4)](/inet/4.md), [inet6(4)](/inet6/4.md), [netintro(4)](/netintro/4.md), [pf(4)](/pf/4.md), [ifconfig(8)](/ifconfig/8.md), [pflogd(8)](/pflogd/8.md)

## HISTORY

The **pflog** device first appeared in OpenBSD 3.0.