Not sure how much of a perl question this really is. Perl sits on top of the OS and relies on calls to the devices drivers to perform IO. But the networking device drivers are designed specifically to abstract the MAC addresses and instead present network addresses to the user process. So you first need a driver to interface to the network stack and return MAC addresses. Sitting on top of that you need a library or module to allow perl to access the driver.

Your question then becomes one of how to interface to the module. Usually a trivial question once you have the module and it's documentation.

Having carefully stated the correct way to approach it; here is the wrong way:

tcpdump -xx |perl -lne '/0000:\s+((\w{4}\s){3})/;print "$1"' -
tcpdump: verbose output suppressed, use -v or -vv for full protocol de
+code
listening on fxp0, link-type EN10MB (Ethernet), capture size 96 bytes

0013 20bc 58b5
0013 20bc 58b5
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
00a0 c9cd 5db1
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
000d 889a 8e32
00a0 c9cd 5db1
00a0 c9cd 5db1
.
.
.
[download]