pflog


solution: custom bpf_mtap_pflog, pflog_bpfcopy

pflog_bpfcopy copies the packet data into the bpf ringbuffer

makes up an mbuf pointing to the bpf buffer

calls pf_setup_pdesc + pf_translate on it

stores original src and dst addresses/ports in the pflog header