snapshot: can sniff on en0!