Nope, my super brilliant plan of briliantness does not seem to work. Interfaces are not created equal. I'll have to figure out another way to feed #suricata pcap data... worst case hack togheter a small deamon that just forwards pflog0 data to vlan12 as intended.