chg: work around a bug in some (?) versions of tcpdump or friend

Some pcap file was encountered with caplen = len+6.
Apparently, ruby does the same thing:
http://www.ruby-doc.org/gems/docs/f/ffi-pcap-0.2.0/FFI/PCap/Packet.html