Captured packets include a link-layer header, which is considered in
the Linux code but not the PCAP code. Also, the actual captured
length is in caplen, not len.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>