Replicating OpenBSD's pflog in Linux: nftables and ulogd2

This article details how to replicate OpenBSD and FreeBSD's convenient pflog functionality on Linux using nftables and ulogd2 for network packet logging and analysis. By adding 'log group' statements to nftables rules and forwarding logs to different netlink sockets, you can use tcpdump for live monitoring and ulogd2 for disk logging. The article walks through configuring ulogd2, logging to pcap files, and notes limitations and alternatives to ulogd2.