the start of an Ethernet packet, can be found by searching kernel memory space for a source MAC address followed by an EtherType of IPv4 or IPv6. As long as the source MAC address is known, the ...