is there any way that i can convince ipf/ipmon to log the link layer
headers from packets that it logs?  i'm logging packets that i don't
expect to see on my network (of course), but without the link layer
headers (ethernet in this case) i have no idea where they're coming
from.

or is this simply not done?

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."