> I'm novice with OpenBSD and , may be > snort -i pflog0 > a kind of bad practice? Or it known problem with OpenBSD 4.0 ?
Won't work. Although pflog does create pcap style output, it is not data that would make sense to snort. Use real interfaces for snort (eg rl0, fxp1, whatever). ciao, chakl
