sync with more-recent LBL 0.4, about loopback interface detection
(/^lo[0-9]?$/).
CAVEAT: with GENERIC kernel on laptops laptops, pcap_lookupdev would almost
always pick eon0 as the interface, and fails because eon0 has no bpf
attachment. we may want to change pcap_lookup{,dev} to check if the
interface has bpf attachment or not.
almost in sync with tcpdump.org source code tree.
"tcp" will match both IPv4 TCP and IPv6 TCP.
"ip6" will match IPv6.
you can chase header chain by using "protochain" instead of "proto"
(but bpf code is not optimizable in this case)
commit to tcpdump will follow.
I've sent this fix to LBL guys to get no response. I wonder why it was.
lukem