Implement several 'ip' modifiers

* doc/Makefile: Add new examples.
* doc/ip-multicast.md: ditto. 
* doc/ip-proto-ah.md: ditto. 
* doc/ip6-multicast.md: ditto. 
* doc/ip6-proto-ah.md: ditto. 
* src/pf/expand.lua: Add expansion of new modifiers for ip: 'broadcast', 'multicast' and 'proto'.
* src/pf/parse.lua: Add support for parsing of ip modifiers.

Agree. I've been researching about this. This is what I found out.

There are two possible interpretations of an ethernet frame. As an Ethernet II frame or as a 802.3 frame [1].

The type field of an ethernet frame can carry either the EtherType identifier or a Length. EtherType identifiers start from 0x600 (1536). This means that when the protocol identifier is >=1536, the value in the Type/Length field ({'[ether]', 12, 2 }) is interpreted as protocol type, as we have been doing so far.

When the protocol identifier is <1536 the value in Type/Length field is interpreted as Length. The IEEE 802.3 specification determines that this value cannot be higher than 1500 (maxValidFrame, see [1]). That explains why "ether proto 1500" emits the following BPF asm: (applies to any value <1500) 

(000) ldh      [12]
(001) jgt      #0x5dc           jt 5	jf 2

In fact there's a gray area between values 1500 and 1536. They cannot be valid 802.3 frames (length is higher than 1500), but they are not Ethernet frames either (ethertypes should be >=1536). The spec doesn't define what to do and leaves it to the implementators (tcpdump considers anything >1500 as an Ethernet frame) [2].

Once this is clarified, now there's still the question of what's the meaning of the first byte after the Type/Length field, when the Type/Length field is interpreted as Length. In this case (<1500), the frame is interpreted as a 802.3 frame, or derivatives. The derivatives include LLC (802.2) and SNAP which prefix the data field with an LLC header. The article in Wikipedia about 802.3 [3] defines the IEEE 802.3 standard as:

"10BASE5 10 Mbit/s (1.25 MB/s) over thick coax. Same as Ethernet II (above) except Type field is replaced by Length, and an 802.2 LLC header follows the 802.3 header. Based on the CSMA/CD Process".

So the first bytes in the payload field are a 802.2 LLC header. The structure of a LLC data header starts with two eight-bit address fields, called service access points. They are the DSAP (Destination SAP) and SSAP (Source SAP). Possible values for a SAP are:

| Value | Hex  | Description |
| 0     | 0x00 | Null LSAP |
| 2     | 0x02 | Individual LLC Sublayer Mgt |
| 3     | 0x03 | Group LLC Sublayer Mgt |
| 4     | 0x04 | SNA Path Control |
| 6     | 0x06 | Reserved for DoD IP |
| 14    | 0x0e | ProWay-LAN |
| 78    | 0x4e | EIA-RS 511 |
| 94    | 0x5e | ISI IP |
| 142   | 0x8e | ProWay-LAN |
| 170   | 0xaa | SNAP Extension Used |
| 224   | 0xe0 | Novell Netware |
| 254   | 0xfe | OSI protocols ISO CLNS IS 8473[2] |
| 255   | 0xff | Global DSAP (cannot be used for SSAP) |

In conclusion, the first byte after the Type/Length field, when the ethernet frame is interpreted as 802.3 data frame, is a SAP. At this level (Link-Layer Control) the concept of SAP is similar to an Ethertype value [4]. 

What the command "ether proto <number>" does when number <1500 is to check the length of the packet and in case it is lower than 1500 compares the first byte after the length ({'[ether]', 14, 1}) against the protocol number.

With regard to SNAP protocol, the structure is the same but adds new fields at the end of the LLC header [5].

[1] Extended Ethernet Frame Size Support https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01)
[2] EtherType http://en.wikipedia.org/wiki/EtherType 
[3] IEE_802.3 http://en.wikipedia.org/wiki/IEEE_802.3
[4] SAP Numbers http://www.wildpackets.com/resources/compendium/reference/sap_numbers
[5] SNAP Protocol http://en.wikipedia.org/wiki/Subnetwork_Access_Protocol