tcpdump -xx |perl -lne '/0000:\s+((\w{4}\s){3})/;print "$1"' -
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on fxp0, link-type EN10MB (Ethernet), capture size 96 bytes

0013 20bc 58b5
0013 20bc 58b5
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
00a0 c9cd 5db1
00a0 c9cd 5db1
.
.
.