Bug, NULL link type field length is actually 4 bytes. See: http://www.tcpdump.org/linktypes.html
Fix, TCP based queries start the message after the first two bytes
Fix testcase
Adhere to standard if-else statement style
Implementation for IPv6 (issue #12)