packet printing is not supported for link type PFLOG

Hello one-to-one:

I just have same problem as you, but I got a temporary solution try to change tcpdump command to this:

tcpdump -lnetttti pflog0 -w /file/path/to/pflog.pcap

-w /file/path/to/pflog.pcap : meaning tell tcpdump to dump to following file and it is recommended to using (.pcap) to be extension.

by the time you wanna check the log that may let you to look the package by using Wireshark or other application.

Hope this can help you.

All the best & Farewell 🙂

As developers of a pf front end app we faced the same problem on macOS 10.12.4 as our apps use tcpdump to read and store pf logs. We believe tcpdump is broken thus we developed 'pfloggerd' a dedicated pf log daemon, to mimic FreeBSD and other operating systems that use pf. The daemon must run as root at boot, it reads from pflog0 interface and stores logs in a human readable format in /var/log/pffirewall.log. Pfloggerd is an open source project available at github.com.

https://github.com/the-tcpdump-group/tcpdump/issues/598 :

Yes, PFLOG is broken.

By "PFLOG" I mean "PFLOG", not "the PFLOG printing code in tcpdump"; it doesn't have a standard specification so that you can print any operating system's PFLOG output on any operating system.

So tcpdump's PFLOG-printing code requires that you have the header file for the OS on which you're compiling tcpdump available, so it can print that OS's version of PFLOG output.

Apple doesn't ship that header file, so we don't support printing PFLOG output on macOS; apparently, they don't support it in their tcpdump, either.

Please complain to Apple about this if you want it fixed, as it's their bug.

A workaround but personaly i prefer tcpdump :

this gives the same output than tcpdump :

tshark -P -i pflog0 -Y pflog -Tfields -T fields -E separator=" " -e frame.time -e frame.number -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e _ws.col.Protocol -e pflog

Better one no buffer flushing data directly to the predefined file :

nohup tshark -l -i pflog0 -Y pflog -Tfields -T fields -E separator=" " -e frame.time -e frame.number -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e _ws.col.Protocol -e pflog >> /var/log/pf.log &