Tables example

spamd is an SMTP tarpit, accepts connections and pretends to be a legitimate MTA, but responds very slowly and discards all data
spews is a list with about 15000 addresses/netblocks of spammers
redirecting incoming SMTP connections from those peers to spamd with a single rule:

rdr on $ext_if inet proto tcp from <spammers> \ 
  to any port smtp -> 127.0.0.1 port 8025

$ pfctl -t spammers -T replace -f file
$ pfctl -t spammers -v -T test 62.65.145.30