tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'

[root@rhel2 postfix]# tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes
07:12:03.603360 CDPv1, ttl: 180s, checksum: 436 (unverified), length 140
Device-ID (0x01), length: 11 bytes: 'cluster1-01'
Port-ID (0x03), length: 3 bytes: 'e0c'
Version String (0x05), length: 66 bytes:
NetApp Release 8.2.1RC1 Cluster-Mode: Wed Nov 20 15:25:04 PST 2013
Platform (0x06), length: 6 bytes: 'SIMBOX'
Address (0x02), length: 22 bytes: IPv4 (2) 192.168.0.111 IPv4 (1) 192.168.0.101
Capability (0x04), length: 4 bytes: (0x00000010): L3 capable
1 packets captured
6 packets received by filter
0 packets dropped by kernel