Problem with Log Filterlog

[oscar.pulgarin]

I am having a problem since the traffic direction should normally be "in" or "out", and in the logs it appears as unknown.
Has anyone had this problem? How do you correct it?

Mar 7 09:02:30 FWASK filterlog[48348]: 85,,,4294967295,igb4,match,pass,unkn(%u),4,0x0,,127,2618,0,none,17,udp,43,172.24.1.6,108.61.171.103,27070,21116,23

[oscar.pulgarin]

@oscar-pulgarin @johnpoz do you know about this?

[johnpoz]

@oscar-pulgarin I rarely look at raw logs.. What is logging that traffic? Do you have some rule that does both directions set to log in your floating tab?

[oscar.pulgarin]

@johnpoz No, that has not been defined.
These are logs that are generated from Filterlog, that is, the logs of the blocking actions or allowing traffic to and from the Pfsense.
The part that appears unkn(%u) should normally be "in" or "out"

[johnpoz]

@oscar-pulgarin I just switched over to showing raw longs, and did a find for last 3000 entries and only thing I see with unkn in it is this

Mar 7 07:57:48 sg4860 filterlog[56621]: 290,,,1512830048,igb2,match,pass,in,4,0x0,,64,0,0,DF,6,tcp,68,192.168.2.203,52.14.255.202,50722,443,0,S,886123752,,65535,,mss;nop;wscale;Unknown Option %u;nop;nop;TS;sackOK;eol

Which has to do with option, not in out direction

[jmchenry]

Just adding info to the thread, I'm seeing this as well.

2025-04-10 23:15:04.712665-04:00 FRONTIER pfB_PRI5_v4 auto rule (1770004411)
2025-04-10 23:15:04.712592-04:00 FRONTIER pfB_Europe_v4 auto rule (1770004467)

First action is block, second is unkn(%u)

[jimp]

This is likely from a rule with the "match" action somewhere, such as Floating rules.

It should be fixed on 25.03 & 2.8.0, or at least appear better in the GUI logs:

https://redmine.pfsense.org/issues/16093

[jmchenry]

I just checked, you are correct. First action on PRI5 is block and second action on Europe is match =)