Thanks! I've tweaked this a bit further, have a look. BIT-1613 #merged
The link-layer addresses are now part of the connection endpoints following the originator-responder-pattern. The addresses are printed with leading zeros. Additionally link-layer addresses are also extracted for 802.11 plus RadioTap.
c$eth_src and c$eth_dst now contain the Ethernet address if available. A new script protocols/conn/mac-logging.bro adds these to conn.log when loaded.
