>   I'm not sure that PPPoE matters because in most cases there is a PPPX
> device which one can use to capture just the PPP packets.

There is a "raw" ethernet interface, where you can gather ethernet packets,
and a pppoe device, where you can tap either PPPoE packets or PPP packets.

In the userland implementations it does not matter, as the PPPoE packets do
not exist inside the kernel, and the ppp device has no choice what packets
to tap.

Our current implementation always taps the PPPoE packets, without choice.

Martin