freebsd stable - Oct 2005 - pf and short packets

Dear ALL!
Maybe someone can help me with my problem? I have no adea what is 
happening with my packets :(

I have 5.4-RELEASE-p8 FreeBSD 5.4-RELEASE-p8 box running pf.
And i have ipcad daemon running (installed from ports)

pf.conf says
pass quick on lo0 all

and when i'm trying to rsh to ipcad that is listening on
anna# netstat -a|grep shell
tcp4       0      0  localhost.shell *.*                    LISTEN

anna# rsh -l root localhost show ip accounting
i got no replay, but pflog says the following:
anna#  tcpdump -n -e -ttt -x -i pflog0 host 127.0.0.1
000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 > 
127.0.0.1.643: . ack 30 win 65535
         0x0000:  4600 002c 6605 4000 0306 11c5 7f00 0001  F..,f.@.........
         0x0010:  7f00 0001 0100 0000 0202 0283 8129 5dab  .............)].
         0x0020:  5db7 f2f2 5010 ffff 7dce 0000            ]...P...}...
000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 > 
127.0.0.1.643: . ack 30 win 65535
         0x0000:  4600 002c d21d 4000 0306 a5ac 7f00 0001  F..,..@.........
         0x0010:  7f00 0001 0100 0000 0202 0283 8129 5dab  .............)].
         0x0020:  5db7 f2f2 5010 ffff 7dce 0000            ]...P...}...

The rule for this packet is not a "log" one, but the sign (short) is 
what i cannot understand. The only place i have found this word is in 
man pflogd (reason why this packet appers in this log)
When i'm disabling pf by pfctl -d everything works just fine and i can 
get my ip accounting.

Best regards,
Anton Nikiforov


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2218 bytes
Desc: S/MIME Cryptographic Signature
Url :
http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20051025/b2356433/smime.bin

On Tuesday 25 October 2005 23:21, Anton Nikiforov wrote:
> ?tcpdump -n -e -ttt -x -i pflog0 host 127.0.0.1
> 000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 >
> 127.0.0.1.643: . ack 30 win 65535
> ? ? ? ? ?0x0000: ?4600 002c 6605 4000 0306 11c5 7f00 0001 ?F..,f.@.........
> ? ? ? ? ?0x0010: ?7f00 0001 0100 0000 0202 0283 8129 5dab ?.............)].
> ? ? ? ? ?0x0020: ?5db7 f2f2 5010 ffff 7dce 0000 ? ? ? ? ? ?]...P...}...
> 000034 rule 0/3(short): pass out on lo0: IP 127.0.0.1.514 >
> 127.0.0.1.643: . ack 30 win 65535
> ? ? ? ? ?0x0000: ?4600 002c d21d 4000 0306 a5ac 7f00 0001 ?F..,..@.........
> ? ? ? ? ?0x0010: ?7f00 0001 0100 0000 0202 0283 8129 5dab ?.............)].
> ? ? ? ? ?0x0020: ?5db7 f2f2 5010 ffff 7dce 0000 ? ? ? ? ? ?]...P...}...
>
> The rule for this packet is not a "log" one, but the sign (short)
is
> what i cannot understand.
Read 'man 1 tcpdump' about key "-s".
You command must be like "tcpdump -s 1000 -n -e -ttt -x -i pflog0 host 
127.0.0.1"

Change value 1000 to appropriate.