move pcap_close to the right place
add support for IPv6-in-IPv4

we need a policy for that kind of traffic cause the current
implementation  only keeps the inner IP-header but maybe the
outer header is more relevant