Hi,

We have a requirement to intercept the incoming packet on particular interface and check for the proprietary tag in the 
packet header. if the tag matches handover the packet to my application otherwise give it to stack. This is achieved as 
follows.

1) Add a hook function as given below

pfil_add_hook( myFunc, NULL, PFIL_IN | PFIL_WAITOK,          ð_input_pfil_hook);

2) Then "myFunc" will receive the packet and inspect for particular interface and proprietary tag and act accordingly.

It is working fine. but we are observing the packet filter is holding 500 mbufs always with it. i.e, "netstat -m" 
command shows that there are 500 mbufs in use before loading the packet filter module and it increases to 1000 after 
loading the packet filter.
Ther are no other processes running in my card and there is no traffic generated from or destined to my card.

is it expected behavoiur with PF? 

Thanks,
Ramakrishna