>> >> okay, that'll blackhole the packets, but i wanna sniff 'em.
>> >
>> >If you really want to do this, a null connector*/teriminator for a UTP port,
>> >get yourself a cheap networking card and send packets out that interface
>> >using ipfilter and hardwired IP#/MAC.  ARP information in place, they'll
>> >get sent out the interface to nothing.
>> 
>> will that ensure that the hardware addresses are intact as received?
>
>No.  Once they go up into the IP layer, your MAC addresses are as good
>as lost anyway.  It just stops ARPs that will never be answered from
>being generated.

rats.  the hardware addresses are what i was most interested in.  the
packets that i don't want are getting to me somehow, presumably by
having an ethernet broadcast (or maybe multicast) destination address.
what i *really* wanted to know was where they were coming from.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."