pfSense

(From a strictly "consumer of tech" point of view, relying on the base system for this is probably going to cause more grief further down the road.)

Couldn't this be replaced with the port/package? e.g. http://www.freshports.org/net/tcpdump/ is now at 4.7.4.

(The FreeBSD base system is going to be pkg-packaged, as you know, so the issue may well go away in time.)

OK, so having run headfirst into the bsdconfig wall, I had a rethink about how to express what this ticket is really about, as I think it's been misunderstood.

It's a bug to ship a feature which can't be diagnosed. The ticket is not about updating tcpdump per se. It's about having a means to diagnose pfSense's behaviour in common IPv6 configurations.

So I'll get around to reopening this at some point. Obviously I can't/don't have the resources to "battle test" pfSense in various IPv6 setups on the scale of e.g. University of New Hampshire Interoperability Laboratory (UNH-IOL), but the big vendors run that gauntlet too.

Having to resort to capturing elsewhere introduces bias -- sometimes, we need to see what the firewall is sending out directly at the source.