Maybe the packet-filters that come with ethereal/tethereal may be of use here (see my previous post today: Re: converting tcpdump output