pflog


how about applying the rewriting to that bpf buffer...

need a custom copy function: pflog_bpfcopy
which implies a custom bpf_mtap

that custom copy funtion knows internals