Yes, kinda. I'm not sure if tcpdump knows exactly that it's a pflog interface but tcpdump knows how to decode the wire format which traverses the pflog interfa

Yes, kinda. I'm not sure if tcpdump knows exactly that it's a pflog interface but tcpdump knows how to decode the wire format which traverses the pflog interface. It's a bit of a weird thing, using a network device for logging information like this, but it works.