Re: pfil_add_ihook() with PFIL_IFNET

 > But, surely, it seems to me the simple thing to do is to just grep for
> PFIL_IFNET_ATTACH and PFIL_IFNET_DETACH and look at the surrounding
> code to see what circumstances they're used in.

Yes, I found that pfil_run_ifhooks() with PFIL_IFNET_ATTACH is called 
from if_initialize(ifnet_t *ifp)
It's called when new network interface is initialized.

Peter