diff --git a/tests/sys/common/vnet.subr b/tests/sys/common/vnet.subr
--- a/tests/sys/common/vnet.subr
+++ b/tests/sys/common/vnet.subr
@@ -135,3 +135,96 @@
 		rm created_interfaces.lst
 	fi
 }
+
+#
+# Wait for a process to start
+#
+wait_for_process_usage()
+{
+	echo "Usage: wait_for_process [OPTIONS] <process_name>"
+	echo "Options:"
+	echo "  -i SEC   Check interval in seconds (default: 1)"
+	echo "  -j JAIL  Run commands inside jail"
+	echo "  -t SEC   Timeout in seconds (default: 30)"
+
+	exit 1
+}
+wait_for_process()
+{
+	local process_name=""
+	local timeout="30"
+	local interval="1"
+	local elapsed jflag start_time
+
+	elapsed=0
+	start_time=$(date +%s)
+
+	while getopts "i:j:t:" option; do
+		case "$option" in
+		i)
+			interval="$OPTARG"
+			;;
+		j)
+			jflag="-j $OPTARG"
+			;;
+		t)
+			timeout="$OPTARG"
+			;;
+		*)
+			wait_for_process_usage
+			;;
+		esac
+	done
+	shift $((OPTIND - 1))
+
+	if [ $# -ne 1 ]; then
+		wait_for_process_usage
+	fi
+
+	process_name="$1"
+
+	case "$interval" in
+	''|*[!0-9]*)
+		echo "wait_for_process: interval must be a positive integer" >&2
+		exit 1
+		;;
+	*)
+		if [ "$interval" -le 0 ]; then
+			echo "wait_for_process: interval must be a positive integer" >&2
+			exit 1
+		fi
+		;;
+	esac
+
+	case "$timeout" in
+	''|*[!0-9]*)
+		echo "wait_for_process: timeout must be a positive integer" >&2
+		exit 1
+		;;
+	*)
+		if [ "$timeout" -le 0 ]; then
+			echo "wait_for_process: timeout must be a positive integer" >&2
+			exit 1
+		fi
+		;;
+	esac
+
+	if [ "$timeout" -lt "$interval" ]; then
+		echo "wait_for_process: timeout must be greater than interval" >&2
+		exit 1
+	fi
+
+	while true; do
+		if pgrep $jflag -fq "$process_name"; then
+			return
+		fi
+
+		elapsed=$(( $(date +%s) - start_time ))
+		if [ $elapsed -ge "$timeout" ]; then
+			echo "wait_for_process: timeout waiting for process '$process_name'" >&2
+			exit 1
+		fi
+
+		sleep "$interval"
+	done
+}
diff --git a/tests/sys/netpfil/pf/pflog.sh b/tests/sys/netpfil/pf/pflog.sh
--- a/tests/sys/netpfil/pf/pflog.sh
+++ b/tests/sys/netpfil/pf/pflog.sh
@@ -337,7 +337,7 @@
 }
 
 atf_test_case "rdr_action" "cleanup"
-rdr_head()
+rdr_action_head()
 {
 	atf_set descr 'Ensure that NAT rule actions are logged correctly'
 	atf_set require.user root
@@ -375,15 +375,13 @@
 		"block quick inet6" \
 		"pass in log"
 
-	jexec ${j}gw tcpdump -n -e -ttt --immediate-mode -l -U -i pflog0 >> ${PWD}/pflog.txt &
-	sleep 1 # Wait for tcpdump to start
+	jexec ${j}gw tcpdump -n -e -ttt --immediate-mode -l -U -i pflog0 >> pflog.txt &
+	# Wait for tcpdump to start
+	wait_for_process -j ${j}gw tcpdump
 
 	# send a SYN to catch in the log
 	jexec ${j}srv nc -N -w 0 198.51.100.2 1234
 
-	echo "Log"
-	cat ${PWD}/pflog.txt
-
 	# log line generated for rdr hit (pre-NAT)
 	atf_check -o match:".*.*rule 0/0\(match\): rdr in on ${epair_srv}b: 198.51.100.1.[0-9]* > 198.51.100.2.1234: Flags \[S\].*" \
 	    cat pflog.txt