Logging

Keyword "log" in the rules to be logged

/etc/pf.conf

set loginterface $ext_if
pass out log from <client> to any port $email label client-email keep state

Logs in binary, tcpdump(8) readable format

label creates counters for statistics

NOTE: log logs only initial packet, use log (all) to log all matching packets