On Wed, May 23, 2012 at 07:50:04PM +0000, Joerg Pulz wrote: > Let me know if you need more output. Oh, we can identify the pfil hook by printing *pfh, pfh->pfil_func and comparing the address to that of pf_check_out, fr_check_wrapper, and the one for ipfw, right? Daniel