I'll be fairly surprised if this is actually correct, but at least it builds and appears to display the right addresses and port numbers.
"mkdir patches" before applying.. Index: Makefile =================================================================== RCS file: /cvs/ports/net/pfflowd/Makefile,v retrieving revision 1.7 diff -u -p -r1.7 Makefile --- Makefile 15 Sep 2007 22:36:58 -0000 1.7 +++ Makefile 16 Jul 2008 14:58:24 -0000 @@ -3,6 +3,7 @@ COMMENT= PF to NetFlow converter DISTNAME= pfflowd-0.7 +PKGNAME= ${DISTNAME}p0 CATEGORIES= net MASTER_SITES= http://www.mindrot.org/files/pfflowd/ Index: patches/patch-pfflowd_c =================================================================== RCS file: patches/patch-pfflowd_c diff -N patches/patch-pfflowd_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-pfflowd_c 16 Jul 2008 14:59:04 -0000 @@ -0,0 +1,43 @@ +$OpenBSD$ +--- pfflowd.c.orig Wed Jun 7 11:58:37 2006 ++++ pfflowd.c Wed Jul 16 15:46:15 2008 +@@ -300,11 +300,15 @@ send_netflow_v1(const struct pfsync_state *st, u_int n + creation = uptime_ms; /* Avoid u_int wrap */ + + if (st[i].direction == PF_OUT) { +- memcpy(&src, &st[i].lan, sizeof(src)); +- memcpy(&dst, &st[i].ext, sizeof(dst)); ++ memcpy(&src, &st[i].key[0].addr[0], sizeof(src)); ++ memcpy(&src.port, &st[i].key[0].port[0], sizeof(src.port)); ++ memcpy(&dst, &st[i].key[0].addr[1], sizeof(dst)); ++ memcpy(&dst.port, &st[i].key[0].port[1], sizeof(dst.port)); + } else { +- memcpy(&src, &st[i].ext, sizeof(src)); +- memcpy(&dst, &st[i].lan, sizeof(dst)); ++ memcpy(&src, &st[i].key[0].addr[1], sizeof(src)); ++ memcpy(&src.port, &st[i].key[0].port[1], sizeof(src.port)); ++ memcpy(&dst, &st[i].key[0].addr[0], sizeof(dst)); ++ memcpy(&dst.port, &st[i].key[0].port[0], sizeof(dst.port)); + } + + flw = (struct NF1_FLOW *)(packet + offset); +@@ -473,11 +477,15 @@ send_netflow_v5(const struct pfsync_state *st, u_int n + creation = uptime_ms; /* Avoid u_int wrap */ + + if (st[i].direction == PF_OUT) { +- memcpy(&src, &st[i].lan, sizeof(src)); +- memcpy(&dst, &st[i].ext, sizeof(dst)); ++ memcpy(&src.addr, &st[i].key[0].addr[0], sizeof(src.addr)); ++ memcpy(&src.port, &st[i].key[0].port[0], sizeof(src.port)); ++ memcpy(&dst.addr, &st[i].key[0].addr[1], sizeof(dst.addr)); ++ memcpy(&dst.port, &st[i].key[0].port[1], sizeof(dst.port)); + } else { +- memcpy(&src, &st[i].ext, sizeof(src)); +- memcpy(&dst, &st[i].lan, sizeof(dst)); ++ memcpy(&src.addr, &st[i].key[0].addr[1], sizeof(src.addr)); ++ memcpy(&src.port, &st[i].key[0].port[1], sizeof(src.port)); ++ memcpy(&dst.addr, &st[i].key[0].addr[0], sizeof(dst.addr)); ++ memcpy(&dst.port, &st[i].key[0].port[0], sizeof(dst.port)); + } + + flw = (struct NF5_FLOW *)(packet + offset); Index: patches/patch-pfflowd_h =================================================================== RCS file: patches/patch-pfflowd_h diff -N patches/patch-pfflowd_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-pfflowd_h 16 Jul 2008 14:59:04 -0000 @@ -0,0 +1,12 @@ +$OpenBSD$ +--- pfflowd.h.orig Wed Jul 16 13:48:31 2008 ++++ pfflowd.h Wed Jul 16 13:48:40 2008 +@@ -29,7 +29,7 @@ + #define DEFAULT_INTERFACE "pfsync0" + #define LIBPCAP_SNAPLEN 2020 /* Default MTU */ + +-#define _PFSYNC_VER 3 ++#define _PFSYNC_VER 4 + + /* + * This is the Cisco Netflow(tm) version 1 packet format