[jggimi]

The pfctl(8) program is the key userland interface, yet you show it in the kernel.

You might want to add the pflog(4) device. If you do, you could ad its userland program pflogd(8). And, you could then add the adjunct program tcpdump(8).