In some email I received from Andrew Brown, sie wrote:
> >> >> okay, that'll blackhole the packets, but i wanna sniff 'em.
> >> >
> >> >If you really want to do this, a null connector*/teriminator for a UTP port,
> >> >get yourself a cheap networking card and send packets out that interface
> >> >using ipfilter and hardwired IP#/MAC.  ARP information in place, they'll
> >> >get sent out the interface to nothing.
> >> 
> >> will that ensure that the hardware addresses are intact as received?
> >
> >No.  Once they go up into the IP layer, your MAC addresses are as good
> >as lost anyway.  It just stops ARPs that will never be answered from
> >being generated.
> 
> rats.  the hardware addresses are what i was most interested in.  the
> packets that i don't want are getting to me somehow, presumably by
> having an ethernet broadcast (or maybe multicast) destination address.
> what i *really* wanted to know was where they were coming from.

Then apply tcpdump to the interface which is receiving them.

Darren