[jggimi]

True. My comments were directed to logging pf actions -- which will record any logged block/pass rule as it is applied (tcpdump -ni pflog0, or tcpdump -nr /var/log/pflog)