| PFLOG(4) | Kernel Interfaces Manual | PFLOG(4) | 
The pflog0 interface is created automatically at boot if both pf(4) and pflogd(8) are enabled; further instances can be created using ifconfig(8).
Each packet retrieved on this interface has a header associated with it of length PFLOG_HDRLEN. This header documents the address family, interface name, rule number, reason, action, and direction of the packet that was logged. This structure, defined in <net/if_pflog.h> looks like
struct pfloghdr { 
	u_int8_t	length; 
	sa_family_t	af; 
	u_int8_t	action; 
	u_int8_t	reason; 
	char		ifname[IFNAMSIZ]; 
	char		ruleset[PF_RULESET_NAME_SIZE]; 
	u_int32_t	rulenr; 
	u_int32_t	subrulenr; 
	uid_t		uid; 
	pid_t		pid; 
	uid_t		rule_uid; 
	pid_t		rule_pid; 
	u_int8_t	dir; 
	u_int8_t	pad[3]; 
};
# ifconfig pflog1 up # tcpdump -n -e -ttt -i pflog1
| May 31, 2007 | NetBSD 7.0 |