firewall high-load performance

[Wojciech Puchar]

>
> Actually, I tracked down the guy who had originally given a poor review
> of pf performance, and it turns out that the missing part of his review
> was related to use of dummynet for bandwidth management.  Since I'm not
> planning to use dummynet for bandwidth management, that's not really a
> factor we need to consider.  It looks like, at this point, pf is a good
> choice.

is there a way to check on running system how much CPU time is used to 
perform firewalling/traffic manager - be it pf or ipfw?