>> i guess i must be wrong, but i presume that if i read from it, i get
>> copies of all ethernet frames received by the host (which is somewhat
>> like reading from an AF_INET, SOCK_RAW socket), but that doesn't seem
>> of much utility to me.
>
>Think a simulator like SIMH-VAX. 

right, i've used that, but that uses bpf.  because it has to.

it also asserts its own ethernet address, so if the kernel didn't
rewrite the source ethernet address when transmitting the packet
(never mind deciding which interface on which to transmit it), and
then rewrite it *back* when replies were received, it wouldn't help
much.

i don't think that's it.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."