> But, surely, it seems to me the simple thing to do is to just grep for
PFIL_IFNET_ATTACH and PFIL_IFNET_DETACH and look at the surrounding code to see what circumstances they're used in.
Yes, I found that pfil_run_ifhooks() with PFIL_IFNET_ATTACH is called from if_initialize(ifnet_t *ifp)
It's called when new network interface is initialized. Peter