Except for remote loggin I am done. I am, however, still trying to better
understand the logs.

For instance. Some samples:
10:28:44.207050 sis0 @0:9 B 10.0.0.2,138 -> 10.0.0.255,138 PR udp len 20
229 IN

Was that accepted or rejected?
What is the long number after the seconds? Fractions of a second? Seems
like overkill if so..so many decimal places...

If these logs are straight as reported from ipf could anyone recommend a
link that would explain ipf's logs? I have found many links and great info
on ipf, but nothing on how to read it's logs.