A packet is kept if its Ethernet source or destination MAC matches any
--mac entry; combined with --ip, both must match. Empty dimensions match
everything, so the unfiltered case is still the same code path.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>