[fwAnalog] fwanalog, FreeBSD and PF

From: Rudi Kramer <rudi.kramer~AT~gmail.com>
Date: Thu Sep 14 2006 - 08:07:14 CEST

Good Morning,

I'm busy trying to setup fwanalog on FreeBSD 6.1 using PF but I receive the following error message:

tcpdump: bad dump file format

<Snipet from fwanalog.out/analog.err>

C: 846592 rule 0/0(match): block in on fxp0: 196.x.x.x.137 > 196.x.x.x.137: UDP, length 50

C:                         *

C: 594470 rule 0/0(match): block in on fxp0: 196.x.x.x.137 > 196.x.x.x.137: UDP, length 50

C:                         *

C: 343338 rule 0/0(match): block in on fxp0: 196.x.x.x.137 > 196.x.x.x.137: UDP, length 50

C:                         *

C: 558290 rule 0/0(match): block in on fxp0: 196.x.x.x.138 > 196.X.x.x.138: UDP, length 201

C:                         *

analog: Warning L: Large number of corrupt lines in logfile   /root/fwanalog.out/fwanalog.all.log: turn debugging on or try different   LOGFORMAT
  (For help on all errors and warnings, see docs/errors.html)     Current logfile format:
      %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%j" %t %v\n

It seems like the tcpdump format used in FreebSD differs from openBSD.

Does anyone have a working config that I can try?

Thanks
Rudi Received on Thu Sep 14 08:07:18 2006