sniff: use pkt:dlt/1

Use the datalink type as returned by pkt:dlt/1. The atoms returned by
dlt/1 are based on the constants defined in the C header files. So
instead of return 'ether' for ethernet traffic, 'en10mb' will be
returned.