Thanks Daniel, I'll give that a go!
I'm surprised no-one has come across this before, is pfstatd not widely

used? I'm looking at using custom snmp traps to gather this information

instead, but that also looks like a non-standard method. What do most

people use for pf performance monitoring?
Cliff.
Daniel Hartmeier wrote:

quoted text
> When the process tries to write to the socket after the connection has

> been closed, it gets a SIGPIPE signal. Without custom signal handling,

> the default action is to terminate the process, see signal(3).

> signal(3).

>

> Basic socket programming issue, the author sucks. Try the patch below ;)

>

> Daniel

>

>

> Index: pfstatd.c

> ===================================================================

> RCS file: /var/cvs/pfstat/pfstatd/pfstatd.c,v

> retrieving revision 1.1.1.1

> diff -u -r1.1.1.1 pfstatd.c

> --- pfstatd.c	11 Jan 2007 16:01:58 -0000	1.1.1.1

> +++ pfstatd.c	26 Mar 2008 17:58:05 -0000

> @@ -39,6 +39,7 @@

>  #include

>  #include

>  #include

> +#include

>  #include

>  #include

>  #include

> @@ -97,6 +98,7 @@

>  	}

>  	if (argc != optind)

>  		usage();

> +	signal(SIGPIPE, SIG_IGN);

>  	if ((fdp = open("/dev/pf", O_RDONLY)) < 0) {

>  		fprintf(stderr, "open: /dev/pf: %s\n", strerror(errno));

>  		return (1);