
sizeof(struct bpf_hdr). On machines that we currently support that can use the old definition (which just covers the size of the data in struct bpf_hdr), use it even though it's a hack. (This was changed for the 'new architectures' case so as to be fail-safe; BPF may waste a few bytes of space per captured packet on new architectures, but now at least it's more likely to work.)