pflow In Your Rule Set

/etc/pf.conf

Specify on a per rule basis:

	pass out log from <client> to port $email \
	label client-email keep state (pflow)
	

or, if you want to collect data on all your traffic:

	  set state-defaults pflow

at the start of your rule set