How does one filter MAC addresses using tcpdump?

tcpdump supports the "ether" qualifier to specify ethernet addresses in the standard colon-separated format. For example, to capture any broadcast traffic:

tcpdump ether broadcast

To capture any traffic sent to or from a given MAC address:

tcpdump ether host e8:2a:ea:11:22:33

(Here the first three octets identify the MAC in question as belonging to an Intel NIC, e8:2a:ea being an OUI assigned to Intel.)

Ethernet qualifiers are one small part of the filter language. The tcpdump cheat sheet collects the host, network, port and TCP-flag expressions that come up most often.