in https://support.sophos.com/support/s/article/KB-000036858?language=en_US please add examples about how to filter for events belonging to specific MAC address with drop-packet-capture command.
This is some times used by support but I cannot find this in any documentation. I thought this was some 'ether switch or whatever.
