Catch non-PPPoE traffic tcpdump -s0 -v -p -n -i eth0.100 'not (ether proto 0x8863 or ether proto 0x8864)'