I want to do some very simple traffic analysis for a single device. I'm using
tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for the host? If so, what?
If you are using static IP addreses there is not a single advantage of filtering by MAC because there is a one-to-one relationship among them, except if the device has a single interface and more than one IP address. In that case we're talking of a "one-to-many" relationship.
In DHCP environments it could happen that an IP address is used by a device now and by another later. In that case is useful to filter by MAC so you can follow the behavior of the same device despite of the IP adddress changing behavior.
Keep in mind that MAC addresses are local. IP packets coming from other LANs through a router, will have the original source MAC replaced with the router's MAC address.
Is there an advantage to using a MAC address capture filter over a (static) IP address for the host?
Depending on the purpose of the capture, certainly.
If so, what?
The advantage of capturing based on MAC address is that you are guaranteed to get all traffic sent or destined to the host.
If you only capture based on IP address, you will not get any non-IP based traffic such as ARP. This would also include any IPv6 traffic if you are capturing based on an IPv4 address.
If you are using an IPv6 address for your filter, you wouldn't get any IPv4 traffic and capturing based on IPv6 can be a bit more complicated as there is often a link-local address, a global address and multiple IPv6 multicast addresses that would apply to the device.
If your 'device' is a single, simply-behaved, IP host then capturing specified by IP address is good.
If however it's a router you might want to filter by ethernet address, as indicated in the first answer. Be warned though if the ethernet address is changing: such as for Hot Standby Router Protocol (HSRP) where routers can use different ethernet addresses.
Indeed, some computers change ethernet address if they are doing various kinds of masquerading or have multiple interfaces.
Also, remember non-IP packets! You might be surprised at how much of it is around.
Lastly, don't forget IPv6. If your device is doing IPv6 you might miss something.