 <p>The <a href="http://code.google.com/p/dpkt/" rel="nofollow noreferrer">dpkt</a> package was <a href="http://stackoverflow.com/questions/85577/search-for-host-with-mac-address-using-python/85632">already mentioned</a> on SO. It allows for parsing TCP/IP packets. I have not yet used it for your case, though.</p>