Packet filter - diagram

[benky]

I've made a diagram about PF. This is what I figuredfrom reading man pages.
Did I got it right?

[benky]

nobody tells me nothing...is this is a rough picture how it works?

[jggimi]

The pfctl(8) program is the key userland interface, yet you show it in the kernel.

You might want to add the pflog(4) device. If you do, you could ad its userland program pflogd(8). And, you could then add the adjunct program tcpdump(8).