typ: check ethType/ipProto when checking ip/tcp fields

Closes #329