>>>>> "Herb" == Herb Peyerl <hpeyerl@beer.org> writes:

    Herb> /etc/ipf.conf: count in on ep0 from any to any count out on
    Herb> ep0 from any to any

    Herb> Or something to that effect and then retrieve the data with
    Herb> ipfstat...

But /etc/ipf.conf and ipfstat are not universal. And doesn't using
this mean every packet going in or out the monitored interface makes a
trip through the Berkeley Packet Filter? [My NetBSD box and source
code is not to hand so I can confirm this.]