pflog want to log the moment we hit the log statement want to log the packet the way pf sees is at that moment but changes not actually written back to the packet yet do not want to copy twice