Improve the "guessing" of the hf_ field and encoding values.

Change-Id: Iaa042ef8b794c265870a04f6659720c321978697
Reviewed-on: https://code.wireshark.org/review/5026
Reviewed-by: Michael Mann <mmann78@netscape.net>