Vendors / Netgate / pfSense / pfSense TCP SYN pass and block

Event type

pfSense TCP SYN pass and block

Raw 29-field IPv4/TCP SYN filterlog CSV; registry clients and distinct stable pass/block rule profiles, Faker packet ID/port/sequence.

PLAIN TEXT 29 fields Generator

pfsense firewall tcp

Preview Sample View Schema

CLI Install

meltr templates install netgate

Overview

What this event covers

Raw IPv4/TCP filterlog body with preserved empty fields. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/netgate/pfsense/filter.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›A TCP SYN packet matches a pass rule.
›A TCP SYN packet matches a block rule.

Security relevance

Informational

Frequency notes

One event/second test rate; no timestamp/syslog envelope or connection lifecycle.

Resources

Docs and tools

Field order and BNF grammar official Native sample confirming empty CSV slots (maintainer-confirmed issue) official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

rule_number

String Required

Position 1 in the native text record. Selected rule.rule_number, decimal string.

Source: Selected rule.rule_number, decimal string.

Format string

Example 101

sub_rule_number

String Required

Position 2 in the native text record. Fixed ''.

Source: Fixed ''.

Format string

anchor

String Required

Position 3 in the native text record. Fixed ''.

Source: Fixed ''.

Format string

tracker

String Required

Position 4 in the native text record. Same rule.tracker, stable decimal string; distinct per action.

Source: Same rule.tracker, stable decimal string; distinct per action.

Format string

Example 1000000101

interface

String Required

Position 5 in the native text record. Same rule.interface, constrained em0.

Source: Same rule.interface, constrained em0.

Format string

Example em0

reason

String Required

Position 6 in the native text record. Fixed 'match'.

Source: Fixed 'match'.

Format string

Example match

action

String Required

Position 7 in the native text record. Same rule.filter_action, pass or block.

Source: Same rule.filter_action, pass or block.

Format string

Example block

direction

String Required

Position 8 in the native text record. Fixed 'in'.

Source: Fixed 'in'.

Format string

Example in

ip_version

String Required

Position 9 in the native text record. Fixed '4'.

Source: Fixed '4'.

Format string

Example 4

tos

String Required

Position 10 in the native text record. Fixed '0x0'.

Source: Fixed '0x0'.

Format string

Example 0x0

ecn

String Required

Position 11 in the native text record. Fixed ''.

Source: Fixed ''.

Format string

ttl

String Required

Position 12 in the native text record. Fixed '64'.

Source: Fixed '64'.

Format string

Example 64

id

String Required

Position 13 in the native text record. Faker pyint(min_value=0, max_value=65535).

Source: Faker pyint(min_value=0, max_value=65535).

Format integer

Example 49340

offset

String Required

Position 14 in the native text record. Fixed '0'.

Source: Fixed '0'.

Format string

Example 0

flags

String Required

Position 15 in the native text record. Fixed 'DF'.

Source: Fixed 'DF'.

Format string

Example DF

protocol_id

String Required

Position 16 in the native text record. Fixed '6'.

Source: Fixed '6'.

Format string

Example 6

protocol_text

String Required

Position 17 in the native text record. Fixed 'tcp'.

Source: Fixed 'tcp'.

Format string

Example tcp

length

String Required

Position 18 in the native text record. Fixed '40'.

Source: Fixed '40'.

Format string

Example 40

source_address

String Required

Position 19 in the native text record. Selected device.ip_address, IPv4.

Source: Selected device.ip_address, IPv4.

Format string

Example 192.0.2.111

destination_address

String Required

Position 20 in the native text record. Same rule.destination_ipv4, IPv4 distinct from client.

Source: Same rule.destination_ipv4, IPv4 distinct from client.

Format string

Example 10.20.1.20

source_port

String Required

Position 21 in the native text record. Faker pyint(min_value=49152, max_value=65535).

Source: Faker pyint(min_value=49152, max_value=65535).

Format integer

Example 64405

destination_port

String Required

Position 22 in the native text record. Same rule.port, fixed 443.

Source: Same rule.port, fixed 443.

Format string

Example 443

data_length

String Required

Position 23 in the native text record. Fixed '0'.

Source: Fixed '0'.

Format string

Example 0

tcp_flags

String Required

Position 24 in the native text record. Fixed 'S'.

Source: Fixed 'S'.

Format string

Example S

sequence_number

String Required

Position 25 in the native text record. Faker pyint(min_value=0, max_value=4294967295).

Source: Faker pyint(min_value=0, max_value=4294967295).

Format integer

Example 453427585

ack_number

String Required

Position 26 in the native text record. Fixed ''.

Source: Fixed ''.

Format string

tcp_window

String Required

Position 27 in the native text record. Fixed '65535'.

Source: Fixed '65535'.

Format string

Example 65535

urg

String Required

Position 28 in the native text record. Fixed ''.

Source: Fixed ''.

Format string

tcp_options

String Required

Position 29 in the native text record. Fixed ''.

Source: Fixed ''.

Format string