>Forgive a question from the clueless, but when I try tcpdump I get:
>
>law:~>tcpdump -i ppp0 icmp
>tcpdump: /dev/bpf0: No such file or directory
>
>What do I need to do?

% su
% cd /dev
% ./MAKEDEV bpf0

(Ok, that's from memory, but you get the idea).

You probably also need to rebuild your kernel with bpf support.  You can
do this by putting

pseudo-device	bpfilter 16

in your kernel config file.

--Ken