Index: sys/net/if_ethersubr.c
===================================================================
RCS file: /cvs/src/sys/net/if_ethersubr.c,v
retrieving revision 1.277
diff -u -p -r1.277 if_ethersubr.c
--- sys/net/if_ethersubr.c	18 Jan 2022 10:48:33 -0000	1.277
+++ sys/net/if_ethersubr.c	29 Jan 2022 02:07:04 -0000
@@ -557,6 +557,13 @@ ether_input(struct ifnet *ifp, struct mb
 		return;
 #endif
 	default:
+#if NBPFILTER > 0
+		{
+			caddr_t ac_bpf = READ_ONCE(ac->ac_bpf);
+			if (ac_bpf)
+				bpf_mtap(ac_bpf, m, BPF_DIRECTION_IN);
+		}
+#endif
 		goto dropanyway;
 	}
 
@@ -690,6 +697,7 @@ ether_ifattach(struct ifnet *ifp)
 	LIST_INIT(&ac->ac_multiaddrs);
 #if NBPFILTER > 0
 	bpfattach(&ifp->if_bpf, ifp, DLT_EN10MB, ETHER_HDR_LEN);
+	bpfattach(&ac->ac_bpf, ifp, DLT_EN3MB, ETHER_HDR_LEN);
 #endif
 }
 
Index: sys/net/bpf.c
===================================================================
RCS file: /cvs/src/sys/net/bpf.c,v
retrieving revision 1.210
diff -u -p -r1.210 bpf.c
--- sys/net/bpf.c	16 Jan 2022 06:27:14 -0000	1.210
+++ sys/net/bpf.c	29 Jan 2022 02:07:04 -0000
@@ -171,6 +171,7 @@ bpf_movein(struct uio *uio, struct bpf_d
 		hlen = 0;
 		break;
 
+	case DLT_EN3MB:
 	case DLT_EN10MB:
 		sockp->sa_family = AF_UNSPEC;
 		/* XXX Would MAXLINKHDR be better? */
Index: sys/netinet/if_ether.h
===================================================================
RCS file: /cvs/src/sys/netinet/if_ether.h,v
retrieving revision 1.83
diff -u -p -r1.83 if_ether.h
--- sys/netinet/if_ether.h	7 Jul 2021 20:19:01 -0000	1.83
+++ sys/netinet/if_ether.h	29 Jan 2022 02:07:04 -0000
@@ -240,6 +240,8 @@ struct	arpcom {
 
 	void	*ac_trunkport;
 	const struct ether_brport *ac_brport;
+
+	caddr_t	 ac_bpf;			/* bpf after everything else */
 };
 
 extern int arpt_keep;				/* arp resolved cache expire */
Index: lib/libpcap/gencode.c
===================================================================
RCS file: /cvs/src/lib/libpcap/gencode.c,v
retrieving revision 1.59
diff -u -p -r1.59 gencode.c
--- lib/libpcap/gencode.c	5 Dec 2021 16:40:24 -0000	1.59
+++ lib/libpcap/gencode.c	29 Jan 2022 02:07:04 -0000
@@ -675,6 +675,7 @@ init_linktype(type)
 
 	switch (type) {
 
+	case DLT_EN3MB:
 	case DLT_EN10MB:
 		off_linktype = 12;
 		off_nl = 14;
@@ -846,6 +847,7 @@ gen_linktype(proto)
 
 	switch (linktype) {
 
+	case DLT_EN3MB:
 	case DLT_EN10MB:
 		if (proto <= ETHERMTU) {
 			/* This is an LLC SAP value */
@@ -1406,13 +1408,19 @@ gen_gateway(eaddr, alist, proto, dir)
 	case Q_IP:
 	case Q_ARP:
 	case Q_RARP:
-		if (linktype == DLT_EN10MB)
+		switch (linktype) {
+		case DLT_EN3MB:
+		case DLT_EN10MB:
 			b0 = gen_ehostop(eaddr, Q_OR);
-		else if (linktype == DLT_FDDI)
+			break;
+		case DLT_FDDI:
 			b0 = gen_fhostop(eaddr, Q_OR);
-		else
+			break;
+		default:
 			bpf_error(
 			    "'gateway' supported only on ethernet or FDDI");
+			break;
+		}
 
 		b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
 		while (*alist) {
@@ -2310,6 +2318,7 @@ gen_scode(name, q)
 		if (proto == Q_LINK) {
 			switch (linktype) {
 
+			case DLT_EN3MB:
 			case DLT_EN10MB:
 				eaddr = pcap_ether_hostton(name);
 				if (eaddr == NULL)
@@ -2666,13 +2675,16 @@ gen_ecode(eaddr, q)
 	struct qual q;
 {
 	if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
-		if (linktype == DLT_EN10MB)
+		switch (linktype) {
+		case DLT_EN3MB:
+		case DLT_EN10MB:
 			return gen_ehostop(eaddr, (int)q.dir);
-		if (linktype == DLT_FDDI)
+		case DLT_FDDI:
 			return gen_fhostop(eaddr, (int)q.dir);
-		if (linktype == DLT_IEEE802_11 ||
-		    linktype == DLT_IEEE802_11_RADIO)
+		case DLT_IEEE802_11:
+		case DLT_IEEE802_11_RADIO:
 			return gen_p80211_hostop(eaddr, (int)q.dir);
+		}
 	}
 	bpf_error("ethernet address used in non-ether expression");
 	/* NOTREACHED */
@@ -3088,13 +3100,16 @@ gen_broadcast(proto)
 
 	case Q_DEFAULT:
 	case Q_LINK:
-		if (linktype == DLT_EN10MB)
+		switch (linktype) {
+		case DLT_EN3MB:
+		case DLT_EN10MB:
 			return gen_ehostop(ebroadcast, Q_DST);
-		if (linktype == DLT_FDDI)
+		case DLT_FDDI:
 			return gen_fhostop(ebroadcast, Q_DST);
-		if (linktype == DLT_IEEE802_11 ||
-		    linktype == DLT_IEEE802_11_RADIO)
+		case DLT_IEEE802_11:
+		case DLT_IEEE802_11_RADIO:
 			return gen_p80211_hostop(ebroadcast, Q_DST);
+		}
 		bpf_error("not a broadcast link");
 		break;
 
@@ -3129,7 +3144,9 @@ gen_multicast(proto)
 
 	case Q_DEFAULT:
 	case Q_LINK:
-		if (linktype == DLT_EN10MB) {
+		switch (linktype) {
+		case DLT_EN3MB:
+		case DLT_EN10MB:
 			/* ether[0] & 1 != 0 */
 			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
 			s->s.k = 0;
@@ -3137,9 +3154,8 @@ gen_multicast(proto)
 			b0->s.k = 1;
 			b0->stmts = s;
 			return b0;
-		}
 
-		if (linktype == DLT_FDDI) {
+		case DLT_FDDI:
 			/* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
 			/* fddi[1] & 1 != 0 */
 			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
@@ -3447,6 +3463,7 @@ gen_vlan(vlan_num)
 
 		switch (linktype) {
 
+		/* EN3MB is after VLAN is stripped? */
 		case DLT_EN10MB:
 			off_linktype = 16;
 			off_nl_nosnap = 18;
Index: lib/libpcap/savefile.c
===================================================================
RCS file: /cvs/src/lib/libpcap/savefile.c,v
retrieving revision 1.17
diff -u -p -r1.17 savefile.c
--- lib/libpcap/savefile.c	27 May 2020 04:24:01 -0000	1.17
+++ lib/libpcap/savefile.c	29 Jan 2022 02:07:04 -0000
@@ -168,6 +168,7 @@ pcap_fopen_offline(FILE *fp, char *errbu
 	/* XXX should handle all types */
 	switch (p->linktype) {
 
+	case DLT_EN3MB:
 	case DLT_EN10MB:
 		linklen = 14;
 		break;
Index: usr.sbin/tcpdump/tcpdump.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/tcpdump.c,v
retrieving revision 1.95
diff -u -p -r1.95 tcpdump.c
--- usr.sbin/tcpdump/tcpdump.c	4 Dec 2020 11:36:13 -0000	1.95
+++ usr.sbin/tcpdump/tcpdump.c	29 Jan 2022 02:07:04 -0000
@@ -111,6 +111,7 @@ struct printer {
 #endif
 
 static struct printer printers[] = {
+	{ ether_if_print,		DLT_EN3MB },
 	{ ether_if_print,		DLT_EN10MB },
 	{ ether_if_print,		DLT_IEEE802 },
 	{ sl_if_print,			DLT_SLIP },