What sorts of packet filters are users running in NetBSD-current?

I am taking a look at adding the screend changes into the current
kernel.  (As soon as I figure out what config.new wants....)

Any guidance/warnings are welcome.

BTW - I am presently running "IPfirewall" on a BSDI system and am
aware of its virtues and shortcomings.  I am look for some experience
with another option on my NetBSD machine.