ipmon opens /dev/ipl for reading and awaits data to be saved from
the packet filter. The binary data read from the device is reprinted in
human readable for, however, IP#s are not mapped back to hostnames, nor are
ports mapped back to service names. The output goes to standard output by
default or a filename, if given on the command line. Should the -s
option be used, output is instead sent to syslogd(8). Messages sent
via syslog have the day, month and year removed from the message, but the
time (including microseconds), as recorded in the log, is still included.
Messages generated by ipmon consist of whitespace separated fields.
Fields common to all messages are:
1. The date of packet receipt. This is suppressed when the message is
sent to syslog.
2. The time of packet receipt. This is in the form HH:MM:SS.F, for hours,
minutes seconds, and fractions of a second (which can be several digits
3. The name of the interface the packet was processed on, e.g., we1.
4. The group and rule number of the rule, e.g., @0:17. These can be
viewed with ipfstat -n.
5. The action: p for passed, b for blocked, for a short
packet, n did not match any rules or L for a log rule.
6. The addresses.
This is actually three fields: the source address and port
(separated by a comma), the -> symbol, and the destination address
and port. E.g.: 18.104.22.168,80 -> 22.214.171.124,1722.
7. PR followed by the protocol name or number, e.g., PR tcp.
8. len followed by the header length and total length of the packet,
e.g., len 20 40.
If the packet is a TCP packet, there will be an additional field starting
with a hyphen followed by letters corresponding to any flags that were set.
See the ipf.conf manual page for a list of letters and their flags.
If the packet is an ICMP packet, there will be two fields at the end,
the first always being icmp, and the next being the ICMP message and
submessage type, separated by a slash, e.g., icmp 3/3 for a port
In order for ipmon to properly work, the kernel option
IPFILTER_LOG must be turned on in your kernel. Please see
options(4) for more details.
ipmon reopens its log file(s) and rereads its configuration file
when it receives a SIGHUP signal.