How can I log the process id associated to a local socket blocked by the PF firewall?

Question

Hi,
There seem to be a problem with mac OSX PF firewall logging capabilities.
I am trying to find the process id associated with a connection attempt blocked by PF. I am replicating, in a way, the feature found in a commercial firewall caled "Little Snitch"
This is the method I have tried so far:
1- I wrote a new pf config file with a ruleset that blocks all outbound connection attempts and logs it (see my ruleset at the bottom)
2- I create the pflog0 interface
sudo ifconfig pflog0 create
3- I load the new pf config file
sudo pfctl -d && sudo pfctl -f ./mypf.conf && sudo pfctl -e
4- I log the blocked packet and try to retrieve the process names
sudo tcpdump -n -e -vvv -ttt -i pflog0 > mypf.log
OR
sudo tcpdump -n -s0 -w ./mypf.pcap
Either way, none of my "mypf.log" or "mypf.pcap" files contains any information about the processes.
Any idea how I could log the PID of the processes?
##my ruleset mypf.conf
##MACRO
host_if = "en0"
##OPTIONS
set loginterface $host_if
set debug misc
set skip on lo
##RULES
#I dont want to log all incomming connection, I just want to block it by default
block in all
#I want to log all attempts from processes to establish a connection outside
block out log (user) all

Answer 1

Hmmm....
Your story is familiar - many folks here are somewhat bewildered by the
technology that keeps coming up in their faces when they think that this
process should be a simple one.  It SHOULD be, but....
SONY Reader software for your PC is designed to 'captivate' you so that
your ereader will function well with their store.  It is, in essence, their
way of managing your elibrary.  And it's proprietary to SONY.   You can add
ebooks to it in a similar way that you can add them to ADE.  Since we're an
ADE forum, I don't have those steps in my reference file - sorry.
As you've explained it, DRM protection is really not the issue here.  ADE's
way of managing the relationship between you and the ebook is to keep track
of who did the original download in a small ID file embedded in the ebook.
ADE is telling you that your husband downloaded the ebook in question, and
that you're not able to read it with your own ID.  The SONY message is
essentially the same thing, but in different and confusing wording, which
makes you believe that DRM protection is getting in your way.  That's
probably not true, because you're not getting a 'No Permission To Copy
Here' message from ADE - their way of telling you that the digital rights
assigned by the publisher, distributor or author will prevent you from
making a copy.  Shame on SONY for confusing the issue!
What you can try is to deauthorize ADE by using the CNTLSHIFTD keys
together after it opens and is waiting for you to do something.  Then,
close ADE.  When you reopen ADE, it will ask you to authorize it, and you
can put your husband's ID in.  ADE now thinks you are your husband, and
will let you access all of his ebooks.  You can copy them to your ereader
at this point and then open them to read - assuming that there really is no
DRM protection that prohibits the copy.
There's more, but let's take this one step at a time, eh?
================