>> rats.  the hardware addresses are what i was most interested in.  the
>> packets that i don't want are getting to me somehow, presumably by
>> having an ethernet broadcast (or maybe multicast) destination address.
>> what i *really* wanted to know was where they were coming from.
>
>Then apply tcpdump to the interface which is receiving them.

i didn't thin kthat was very practical.

i'll either (a) waste a lot of cpu in the bpf stuff filtering out the
stuff that ipfilter is already filtering or (b) losing (or missing)
packets or (c) gathering way too much data.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."