#!/bin/sh
tcpdump -tt -xx -r "$@" | awk '
$2 == "PPPoE" {
  if (timestamp != "" && hexstr != "") {
    gsub(/../, " &", hexstr);
    print timestamp, "000000", hexstr;
  }
  hexstr = "";
  timestamp = $1;
  pppoenr = NR;
  next;
}
pppoenr > 0 && $1 ~ /^0x[0-9a-f]+:$/ {
  for (i = 2; i <= NF; i++) {
    hexstr = hexstr $i;
  }
}
END {
  if (timestamp != "" && hexstr != "") {
    gsub(/../, " &", hexstr);
    print timestamp, "000000", hexstr;
  }
}
' | text2pcap -e 0x8864 -q -t %s. /dev/stdin /dev/stdout