BPFLOGD(8)

NAME
bpflogd - Berkeley Packet Filter logging daemon

SYNOPSIS
bpflogd [-dPp] [-F filterfile] [-s snaplen] [-u user] [-w waitms] [-y datalinktype] -f filename -i interface [expression]

DESCRIPTION
bpflogd is a daemon which captures packets using bpf(4) and writes the packets to a logfile in tcpdump(8) binary format. These logs can be reviewed later using the -r option of tcpdump(8).

When starting up, bpflogd drops privileges before opening its log file. After receiving a SIGHUP signal it will write any pending packets to the log file, close it, and then open it again, permitting newsyslog(8) to rotate logfiles automatically. If the log file contains data after being opened, the PCAP header is checked before new logs are appended to the existing file.

The options are as follows:

-d  Debugging mode. bpflogd does not daemonise and logs to the terminal.

-f filename
    Log output filename. The file must already exist, and be readable and writable by the _pflogd user.

-F filterfile
    Specify a file containing a filter expression as per pcap-filter(5).

-i interface
    Specifies the interface to capture packets on using bpf(4). This can be specified multiple times to capture packets from multiple interfaces, but all the interfaces must support the same datalink type.

-P  Put the interfaces into promiscuous mode.

-p  Do not put the interfaces into promiscuous mode. This is the default.

-s snaplen
    Capture at most the first snaplen bytes of data from each packet. By default bpflogd captures whole packets.

-u user
    Drop privileges to user. By default bpflogd drops privileges to the _pflogd user.

-w waitms
    Specify the maximum amount of time in milliseconds between when a packet is captured and when it will be written to the log file. The default waitms value is 2000 milliseconds.

-y datalinktype
    Specify the datalink type when capturing packets. If this is not specified then the default datalink type on the first interface is used.

expression
    Specify a filter expression for matching packets as per pcap-filter(5).

A filter expression may only be specified by a file with -F or as arguments on the command line; specifying both is unsupported. If a filter is not provided then all packets are captured.

SEE ALSO
pcap_open_live(3), pcap-filter(5), newsyslog(8), tcpdump(8)

HISTORY
The bpflogd command appeared in OpenBSD 7.8.