fix snapshot length retrieval

This pull request fixes #626.
At some point in time, the libpcap function pcap_snapshot has changed the return value type.
tcpdump uses for this information also still 16 bit short to save the capture. Wireshark seem to use 32 bit integer instead. This overflows the stack variable snaplen which is also 16 bit.