Firstly, I don't see why changing the filtering rules currently in
   use should require you to reload the entire ruleset.  To change a
   single rule then requires you to `disconnect' from the network
   (ifconfig down), remove the BPF rules, load a new set, and ifconfig
   up.

Those two statements are unrelated.  The ability to install a new
filter program is quite distinct from the actual mechanics of
uploading the program to the kernel.  I don't see why it should ever
be necessary to turn the network interface off.