Logging

through bpf, virtual network interface pflog0
link layer header used for pf related information (rule, action)
binary log files, readable with tcpdump and other tools