Get working with pfctl -vvsr output
$ sudo pfctl -vvsr @0 scrub in all fragment reassemble [ Evaluations: 6116699 Packets: 3069556 Bytes: 646214426 States: 0 ] [ Inserted: uid 0 pid 2006 ] @0 block return log all [ Evaluations: 102723 Packets: 2539 Bytes: 269448 States: 0 ] [ Inserted: uid 0 pid 2006 ] @1 block return log quick from <bruteforce:1> to any [ Evaluations: 102723 Packets: 40 Bytes: 2384 States: 0 ] [ Inserted: uid 0 pid 2006 ] @2 anchor "ftp-proxy/*" all [ Evaluations: 102683 Packets: 28044 Bytes: 22617668 States: 0 ] [ Inserted: uid 0 pid 2006 ]
Trace your packet's path through the logic in the loaded rule set.
What's the last matching rule? Any quick rules to watch for?