In Open Firmware, change the io to telnet (pick an unused address accessible by your other Mac)
" enet:telnet,10.1.42.148" io

Get some Open Firmware info:
dev / ls
dump-device-tree
words

In the dump-device-tree output, there's some memory ranges for the ROM. I guess you just want the boot-rom part (in my case, address:fff00000 length:00100000)

/rom@ff800000
PROPERTIES:
name                    rom
reg                     ff800000  00000000 
ranges                  ff800000  00800000  ff800000 
#address-cells          00000001 

METHODS:
encode-unit     decode-unit     close           open            

/rom@ff800000/boot-rom@fff00000
PROPERTIES:
name                    boot-rom
reg                     fff00000  00100000 
write-characteristic    flash
model                   Apple PowerMac2,1 4.1.9f1 BootROM built on 09/14/01 at 13:18:04
BootROM-version         $0004.19f1
BootROM-build-date      09/14/01 at 13:18:04
security-modes          6e6f6e65 2c206675 6c6c2c20 636f6d6d 616e64

info                    fff00000 00003f00 000419f1 20010914 43b8671b
                        fff08000 00078001 000419f1 20010914 f05f6b03
                        fff80000 00080002 000419f1 20010914 d85d3f5a
                        fff03f00 00000083 000419f1 20010914 a7233187
                        fff03f80 00000084 e1dd2819 15a81001 ffffffff
                        fff04000 00004005 6e767261 6d000000 00000000 		nvram


info                    fff00000 00003f00 000419f1 20010914 43b8671b
                        fff03f00 00000083 000419f1 20010914 a7233187
                        fff03f80 00000084 e1dd2819 15a81001 ffffffff
                        fff04000 00004005 6e767261 6d000000 00000000 		nvram
                        fff08000 00078001 000419f1 20010914 f05f6b03
                        fff80000 00080002 000419f1 20010914 d85d3f5a

has-config-block        


Create a command to dump the bytes (this is more efficient than dump because it doesn't include extra characters)
: dumpbytes bounds ?do i c@ 2.r loop ;

For Old World Macs (which don't have 2.r):
: dumpbytes bounds ?do i c@ 2 u.r loop ;

On the destination Mac:
telnet 10.1.42.148 > thecapture.txt

In Open Firmware, you might need to map the ROM bytes first:
fff00000 dup 100000 28 do-map

Then dump the ROM bytes:
fff00000 100000 dumpbytes
