New in 4.5: pflow(4) and pflow state option

pflow(4) pseudo-device exports netflow v5 data

/etc/pf.conf

		pass out log from <client> to any port $email \
		label client-email keep state (pflow)