pflog


one solution: hide and hope nobody notices it

another solution: copy the mbuf, rewrite, pass up, discard
but c'mon... an extra copy is stupid and slow

almost realistic option: defer the pflog_packet calls to until after the rewrite is really done
but we had other plans...

so: get dirty in bpf land...