Support ip totallen=0x0000 in TSO case.

This also adds some more sanity checks to stay within the captured buffer.

On FreeBSD Apache Server I see frequently ServerHello messages with ip_totallen=0x0000. It looks like this is a known konsequence of TCP offloading (TSO). I fix this by asuming the rest of the captured package as payload. I actually use the captured length to avoid some buffer overflows (but not all cases are yet covered).

We might need to distinguish between the known length and the caputed one for diagnostic messages? 

Would you prefer to have a single capture length check at the beginning or always check the bytes present needed for the next step of analysis?