Sake Blok

> Really sorry for being annoying but is there a chance to see it implemented anytime soon? We're currently having to deal with gigabyte long packet captures for mere minutes...

In that case, I just tried to use negative offsets (thanks for the link, I learned something new): ``` sake@x201:~$ sudo tcpdump -d -i enp0s25 vlan 100 [sudo] password for...

> I recommend using `ether[-4052]=100` - note that the code that libpcap uses `ldb` and your examples use `ldh`. The negative offset is simply a flag, I suspect that _any_...

This PR will also (partly?) solve issue #1379