To use my #OpenBSD-laptop as a wiretap: I bridge the 2 nw-cards and add a (virtual) span-device to the bridge, then tcpdump the span-device?