pflog_read_live
if ((hpcap = pflog_read_live(pflogif, PCAPSNAP, 1, PCAPTIMO,
hpcap = pflog_read_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
pcap_t *pflog_read_live(const char *, int, int, int, char *);