Измененный pflog в 4.9, неправильно собрается статистика cnupm'а

cnupm некорректно собирает статистику с pflog

Судя по Changelog'у, на интерфейсе pflog увеличили заголовки пакетов.
* Made a pflog(4) overhaul to fix wrong logging of nat/rdr addresses. The pflog header is now longer.
* Fixed tcpdump(8) printing of pflog(4).
* Fixed filtering with new pflog(4) headers.

Спирт не саппортится с 2008 года, видимо придется самому править исходники.
Кто-нибудь ковырял их? Сам разобраться не могу :)

[4.9]# /usr/local/sbin/cnupmstat -uroot -En pflog0
2011-10-27 12:43:59 20.0.17.0 100.2.0.0 1 0
2011-10-27 12:43:59 20.0.150.0 100.2.0.0 1 0
2011-10-27 12:43:59 20.0.173.5 100.2.0.0 1 0
2011-10-27 12:44:59 20.0.157.146 100.2.0.0 0 2048
2011-10-27 12:44:59 20.0.30.149 100.2.0.0 0 7168
2011-10-27 12:44:59 20.0.225.202 100.2.0.0 0 0
2011-10-27 12:44:59 20.0.91.218 100.2.0.0 0 2048
2011-10-27 12:44:59 20.0.107.255 100.2.0.0 0 3584
2011-10-27 12:44:59 20.0.0.0 100.2.0.0 0 312320
2011-10-27 12:44:59 20.0.17.0 100.2.0.0 0 68608
2011-10-27 12:44:59 20.0.32.0 100.2.0.0 0 2048
2011-10-27 12:44:59 20.0.150.0 100.2.0.0 0 143104
2011-10-27 12:44:59 20.0.151.0 100.2.0.0 0 6656
2011-10-27 12:44:59 20.0.160.5 100.2.0.0 0 82432
2011-10-27 12:44:59 20.0.162.5 100.2.0.0 0 3328
2011-10-27 12:44:59 20.0.167.5 100.2.0.0 0 6912
2011-10-27 12:44:59 20.0.171.5 100.2.0.0 0 3328
2011-10-27 12:44:59 20.0.173.5 100.2.0.0 0 11264
2011-10-27 12:44:59 20.0.174.5 100.2.0.0 0 3072

хотя на tcpdump'е ходят совсем другие адреса:
0 mx [4.9]# tcpdump -n -ipflog0
tcpdump: WARNING: snaplen raised from 116 to 160
tcpdump: listening on pflog0, link-type PFLOG
12:45:45.034465 192.168.226.34.51209 > 82.194.234.108.22: . ack 1726004055 win 256 (DF)
12:45:45.034486 192.168.226.34.51209 > 82.194.234.108.22: . ack 121 win 256 (DF)
12:45:45.045260 82.194.234.108.22 > 192.168.226.34.51209: P 121:221(100) ack 0 win 2190 (DF) [tos 0x10]
12:45:45.244911 192.168.226.34.51209 > 82.194.234.108.22: . ack 221 win 255 (DF)
12:45:45.808455 192.168.226.34 > 82.194.234.108: icmp: echo request
12:45:45.808480 82.194.234.108 > 192.168.226.34: icmp: echo reply
12:45:46.039944 82.194.234.108.22 > 192.168.226.34.51209: P 221:433(212) ack 0 win 2190 (DF) [tos 0x10]
12:45:46.040035 82.194.234.108.22 > 192.168.226.34.51209: P 433:661(228) ack 0 win 2190 (DF) [tos 0x10]
12:45:46.040106 82.194.234.108.22 > 192.168.226.34.51209: P 661:841(180) ack 0 win 2190 (DF) [tos 0x10]
12:45:46.041145 192.168.226.34.51209 > 82.194.234.108.22: . ack 841 win 253 (DF)
12:45:46.812353 192.168.226.34 > 82.194.234.108: icmp: echo request
12:45:46.812370 82.194.234.108 > 192.168.226.34: icmp: echo reply
12:45:46.899548 82.194.234.108.15158 > 192.168.114.200.123: v4 client strat 0 poll 0 prec 0 [tos 0x10]
12:45:46.900113 192.168.114.200.123 > 82.194.234.108.15158: v4 server strat 3 poll 0 prec -6 [tos 0x10]
12:45:47.039655 82.194.234.108.22 > 192.168.226.34.51209: P 841:1197(356) ack 0 win 2190 (DF) [tos 0x10]
12:45:47.039752 82.194.234.108.22 > 192.168.226.34.51209: P 1197:1457(260) ack 0 win 2190 (DF) [tos 0x10]
12:45:47.039859 82.194.234.108.22 > 192.168.226.34.51209: P 1457:1717(260) ack 0 win 2190 (DF) [tos 0x10]
12:45:47.040881 192.168.226.34.51209 > 82.194.234.108.22: . ack 1717 win 256 (DF)
12:45:47.816252 192.168.226.34 > 82.194.234.108: icmp: echo request
12:45:47.816279 82.194.234.108 > 192.168.226.34: icmp: echo reply
12:45:48.039507 82.194.234.108.22 > 192.168.226.34.51209: P 1717:2089(372) ack 0 win 2190 (DF) [tos 0x10]
12:45:48.039603 82.194.234.108.22 > 192.168.226.34.51209: P 2089:2349(260) ack 0 win 2190 (DF) [tos 0x10]
12:45:48.040695 192.168.226.34.51209 > 82.194.234.108.22: . ack 2349 win 254 (DF)
12:45:48.819940 192.168.226.34 > 82.194.234.108: icmp: echo request
12:45:48.819966 82.194.234.108 > 192.168.226.34: icmp: echo reply