before ruleset evaluation set up a pf_pdesc describes the packet pointers to headers, offsets to headers/fields remembers addresses + ports before and after rewriting various flags pf_setup_pdesc() does some sanity checks on the packet before