CARP traffic logged : Logs fulls

[aniodon]

Hi Pfsense community !

I have an issue with my logs, they are all instantly full.

When i open the Filter.log, i see a lot of log related to VRRP (CARP) traffic.
I setted up CARP, it works quite fine (MASTER/SLAVES etc)

The Log is full of logs like this :
filterlog: 52,16777216,,1000000201,em5,match,block,in,4,0x10,,255,8711,0,DF,112,carp,56,51.255.27.185,224.0.0.18,advertise,255,1,2,0,1

Is this normal ? Is there any way not to log this ?
How can i know which rule blocked this? (52,16777216,,1000000201)  ?

Thank you all for your help !

PS: I also use SNORT & PFBLOCKERNG
PS2: The problem for this is that my Firewall Log tab (in the webgui) is hard to filter/see , as the logs are full and rotated really fast

[fwcheck]

If you have
block bogons
enabled, check
status > system logs > settings
and unchek

Log packets blocked by 'Block Bogon Networks' rules

In this way i was able not to log HSRP router traffic.

You could also use the rule extra options and unset

Log packets that are handled by this rule

[aniodon]

hello fwcheck !

I thank you for your suggestion, did not saw this option.
I just used it, but i still get carp advertisement.

In fact, i got log on interfaces with no block bogon

I think somethig is still logging this traffic.

Is there any way to find wich rule just triggered, according to the numbers in the log above?

[viragomann]

You can display the rule names in the GUI if set when you set the option "Where to show rule descriptions" in the log settings.

[aniodon]

Hey !

Thanks !
But the problem is that this traffic is logged in the .log on disk, but never displayed on the GUI .
I know i can find informations by clicking on the red icon on the left in the firewall log page, but as they are not displayed i can't !

As a result, i have a very limited Firewall view displayed (1 or 2 lines), everything is inside the log file as CARP  advertising traffic

[aniodon]

Hello guys !

Just made some progress here.

i found a command on the web to list the rules applied :

pfctl -s rules -vv

And with this command i have been able to track the rule that was triggered  :

@52(1000000201) block drop in log quick proto carp from (self:47) to any
  [ Evaluations: 82130    Packets: 39625    Bytes: 2219000    States: 0    ]
  [ Inserted: pid 15144 State Creations: 0    ]

Fun fact, when i go to the firewall log tab, if i switch to "Raw Display" , all these rules are displayed.

Please do someone know how to disable logging for this rule?

PS: I ticked the "Suppress ARP messages" in system Advanced network , on and off, same behaviour
PS2: And by the way i found this similar issue : https://forum.pfsense.org/index.php?topic=31379.0  This looks like it was a layer 2 loop. How can this be troubleshooted?

[Derelict]

I would fix the source of the problem (your layer 2 gear sending its own advertisements back to you.) instead of suppressing the logs. They are telling you there is a problem.