In some email I received from Andrew Brown, sie wrote: [...] > (1) filter based on mac addr? > (2) log the mac addr? Both of the above, I expect... > (3) use tcpdump on only "inbound" or "outbound" packets? ...but not this. That's another code path entirely. Darren