Actually, you should be able to tcpdump ...

The interface isn't the problem. It's how to start tcpdump and see its output. The player must be running, since it's the DHCP client, which means that you can't do it over the serial port, and if it doesn't yet have an IP address, you can't do it via telnet.

Which leaves your later suggestion, which is essentially the same as the one I made previously, except you logically point out that you could conceivably mount a filesystem r/w before then and write to a regular file.

Regardless, Mark seems to have found where the problem lies. I suppose he could use this to verify that the empeg never sees the initial DHCP packet(s).