Here is an example
Code:
# tcpdump -n -e -ttt -i pflog0 src host 192.168.110.70
tcpdump: WARNING: snaplen raised from 116 to 160
tcpdump: listening on pflog0, link-type PFLOG
Aug 04 11:15:16.653652 rule 43/(match) pass in on vlan110: 192.168.110.70.62347 > 192.168.120.3.53: 14227+[|domain]
Aug 04 11:15:17.653134 rule 43/(match) pass in on vlan110: 192.168.110.70.62347 > 192.168.120.2.53: 14227+[|domain]
Aug 04 11:15:28.655046 rule 57/(match) pass in on vlan110: 192.168.110.70.137 > 192.168.110.255.137: udp 50