pflow(4) pseudo-device exports netflow v5 data
/etc/pf.conf
pass out log from <client> to any port $email \ label client-email keep state (pflow)