+ *
+ * XXX - also, it fetches the TCP checksum field in COMPRESSED_TCP
+ * packets with GET_HE_U_2, rather than with GET_BE_U_2(); RFC 1144 says
+ * it's "the unmodified TCP checksum", which would imply that it's
+ * big-endian, but perhaps, on the platform where this was developed,
+ * the packets were munged by the networking stack before being handed
+ * to the packet capture mechanism.