tcpdump is your friend

tcpdump has PF smarts for pflog interfaces, such as

tcpdump -n -e -ttt -i pflog0 inbound and action block and on wi0


$ sudo tcpdump -n -ttt -i pflog0 port domain
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: listening on pflog0, link-type PFLOG
Sep 30 14:27:41.260190 >[|domain]
Sep 30 14:27:41.260253 >[|domain]
Sep 30 14:27:41.260267 >[|domain]
Sep 30 14:27:41.260638 >[|domain]
Sep 30 14:27:41.260798 >[|domain]
Sep 30 14:27:41.260923 >[|domain]