Hi,

On one of my firewalls, running OpenBSD 7.9-stable, the pf logs are
currently flooded by logs like this ones (every 20ms), caused by an
application that sends large UDP broadcast packages at this rate. The
multicast packets are emitted with a TTL of 32 which is useless since
we don't run a multicast routing daemon on the firewall, but I can't
change the application.

08:47:43.531074 rule def/(match) pass in on vlan4: 192.168.2.54.50748 >
239.255.0.1.29151:  truncated-udp - 5236 bytes missing!udp 1472 (frag
25065:1480@0+)
08:47:43.531099 rule def/(match) pass in on vlan4: 192.168.2.54 >
239.255.0.1: (frag 25065:1480@1480+)
08:47:43.531129 rule def/(match) pass in on vlan4: 192.168.2.54 >
239.255.0.1: (frag 25065:1480@2960+)
08:47:43.531161 rule def/(match) pass in on vlan4: 192.168.2.54 >
239.255.0.1: (frag 25065:1480@4440+)


There is no rule in /etc/pf.conf that requests thoses logs
explicitely. Is there a way to disable this logging whithout killing
the whole pflogd(8) daemon ?

(Not only it fills the disks, but it also create extra system load on
the firewall that could be avoided)
-- 
Matthieu Herrb