Earlier today I wrote:
  The packet in question is an init packet, used to
start up a link.
 
 If tcpdump knew about this, it would look somewhat like: 
Since there really is a need for a tool to examine various kinds of DEC
protocol traffic, I am trying to put one together.  In case anyone is
interested:
  
http://https://www.pdc.kth.se/~bygg/tops/anfdump.tar
Don't let the ANF part of the name fool you!  It can do the following:
  *  listen for ethernet frames with ANF-10, DECnet and LAT.
  *  listen for DDCMP (simh-style over TCP or UDP), with decoding
     of payload (ANF-10 or DECnet).
  *  listen for Multinet over TCP, with decoding of DECnet.
  *  do several of the above, in parallel, if you want to see how
     a box in the middle molests your data.
  *  read (and write) pcap-format files.
As usual this is a work-in-progress, and some things (like the manual)
are missing, but the code mostly works.  Use the -h flag for help at
this time.
--Johnny