li: don't bail detection too early

`undefined' could be returned when the other side of the connection
wasn't seen.  Instead, return `unknown', indicating that there could
still be a reliable result in the future.  This change doesn't affect
proper first packet detection.

While there, match protocol names case-insensitive.  Some people do
like their shift button it seems.