README: Warn about default promisc mode
handshake header too short: display remaining payload bytes (possibly negative)

This really should check for underflows/overflows, but at least fix the c&p error.
Support iptotallen=0x0000 in TSO case.

This also adds some more sanity checks to stay within the captured buffer.