tcpdump, ethereal, wireshark, snoop, etc all use the pcap file format for saving packet capture information. That means you can capture information from say OpenBSD PF and then analyse the data in wireshark. The only problem I find is that capture files can get huge and when that happens they are a real PITA to analyse.
