Hello, Thank you all for your help. Since version 7.4, the solution is to run a tcpdump on the pfsync parent interface. For those who are interested in logging nat translation you can find our (dirty) code to do it here: https://github.com/solune/logNat/blob/main/logNat.c
Regards Marc > On 8 Nov 2024, at 17:05, Stuart Henderson <stu.li...@spacehopper.org> wrote: > > On 2024-11-07, Marc Boisis <marc.boi...@univ-lr.fr> wrote: >> >> Hello, >> >> In openBSD 7.3 and before we used tcpdump on pfsync0 to log NAT translation >> . >> Since 7.4 , tcpdump only show "16:57:17.115752 PFSYNCv69 len 1488" >> >> Have you got a solution to log NAT translation since OpenBSD 7.4 ? > > Oh that's a neat trick. > > It's only tcpdump on pfsync0 that's broken, tcpdump on pfsync's > parent interface still works. > > > -- > Please keep replies on the mailing list. >
