I have a bridge0 which has members em0 (wan) and vge0 (lan)

I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both the passed and blocked packets from em0

How can I tcpdump just the passed packets?

If I tcpdump -i vge0 I get the ssh/tcpdump traffic too.

My thoughts at this point are to create a "virtual" nic and add it to the bridge0 and tcpdump on that but the best I have found are dead ends on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.