ipfcount reads ipf(8) logs and extracts the following fields:

  iface group rule action shost sport dhost dport proto flags type dir

You can then print lists like 'top <n> blocked ports', 'top <n> blocked hosts',
or 'incoming connections sorted by interface and protocol'.

For more sophisticated lists, you can filter the entries using Perl expressions.

WWW: http://deathbeforedecaf.net/misc/ports