rule def/(short) in tcpdump -e

[Axel Rau]

Hi,

what does
rule def/(short) [uid 0, pid 0] pass in
mean in the tcpdumped pflog?

Thanks, Axel
---
PGP-Key:29E99DD6 ☀ [phone] ☀ computing @ chaos claudius

[Henning Brauer]

Post by Axel Rau
what does
rule def/(short) [uid 0, pid 0] pass in
mean in the tcpdumped pflog?

def: matched the implicit default rule
short: the reason why the packet was dropped - it was shorter than it
should have been, aka pbly truncated (or malicious). grep for
PFRES_SHORT in sys/net/pf*.c for the exact cases.

when you see packets being dropped referring to the default rule taht
means as much as pf dropped it for non-rule based reasons, i. e. too
short packets and the like, that usually happens before ruleset eval.

[Axel Rau]

Post by Henning Brauer
def: matched the implicit default rule
short: the reason why the packet was dropped - it was shorter than it
should have been, aka pbly truncated (or malicious). grep for
PFRES_SHORT in sys/net/pf*.c for the exact cases.
when you see packets being dropped referring to the default rule taht
means as much as pf dropped it for non-rule based reasons, i. e. too
short packets and the like, that usually happens before ruleset eval.

Thanks!
Axel
---
PGP-Key:29E99DD6 ☀ [phone] ☀ computing @ chaos claudius