I haven't tried examining the traffic with tcpdump but I netboot a 
DEC 3000 - M400 using

>>>  boot ez0

as per the user guide.  It's  show dev  also calls the 10baseT 
interface ESA0, so perhaps this will work for your 400S too.

I didn't attempt a netboot before upgrading to the latest firmware, 
which might be important.  If you want/need to upgrade, beware that 
it's vitally important to have an SROM with the correct version, as 
per

http://www.xray.mpe.mpg.de/mailing-lists/tru64-unix-managers/9507/msg00317.html

I guess you've also noticed it's necessary to have the  vm=rfc1048 
option in /etc/bootptab for these machines?


Ray