Hammer into users' heads the idea that they must use pcap_datalink().

Note for pcap_loop()/pcap_dispatch(), and for
pcap_next()/pcap_next_ex(), that in order to interpret the packets you
have to know the link-layer header type for the pcap_t, as returned by
pcap_datalink().

Note in all the places we discuss the value returned by pcap_datalink()
that the program *MUST NOT ASSUME* that it will return a particular
value, and specifically note that the Linux "any" device has a
pcap_datalink() value of DLT_LINUX_SLL even if all the network
interfaces on the system happen to have some other link-layer header
type.