How to use Packet Filter option for live logs IP adress

In that case I'd suggest, open a putty session > login with the root
under the cd /var/log directory and execute the following cmd:
#cat /var/log/packetfilter.log | grep <srcip=x.x.x.x> | grep <dstip=xxxx>

I put on the filtering following

srcip="172.10.10.1"  and try to connect

It show me now

 UDP 172.10.10.1:500--->20.20.100.12:500

TCP 172.10.10.1:49688--->20.20.100.12:6501

UDP 172.10.10.1:49689--->20.20.100.12:6502

TCP 172.10.10.1:49690--->20.20.100.12:6502

What should I now define as services???

Alright so in the following example:

 TCP 172.10.10.1:500--->20.20.100.12:500

this is your srcip - 172.10.10.1 | srcport - 49688 | dstip - 20.20.100.12 | dstport - 6501
services are 49688 & 6501
now try to filter out the service/ip you are looking for !

can I create a service from 48000:49999? Or what is the best praxis?

What is with 6501 and 6502 and 500?

can I create a service from 48000:49999? 
Yes, you can > under the Definitions & users > Service definitions 
UDP Port 500 service is used for IPsec
TCP Port 6501/6502 are used for endpoint communication.
https://www.auditmypc.com/tcp-port-6501.asp
https://www.auditmypc.com/tcp-port-6502.asp

should I not create services for ports 6501/6502 and 500???? But it seems it is dropped

if the packets are dropped, then no need to create it !
by default any service which is not explicitly allowed in the firewall rules, will be dropped Nick KEY 

I will try it without the service definition for  ports 6501/6502 and 500, if I have still issue with that ports, can I create it?

Yes you can !

I will try it without the service definition for  ports 6501/6502 and 500, if I have still issue with that ports, can I create it? Yes Or NOT? What do you mean?