Compression: Minimize Pcap header size

[pflarr]

Expected Savings: 0.94%
Difficulty: Easy

Pcap headers are 128 bytes per packet.

typedef struct pcaprec_hdr_s {
        guint32 ts_sec;         /* timestamp seconds */
        guint32 ts_usec;        /* timestamp microseconds */
        guint32 incl_len;       /* number of octets of packet saved in file */
        guint32 orig_len;       /* actual length of packet */
} pcaprec_hdr_t;

• The length of the packet is used, but for pcapdb the orig length should never be.
• Unlike with standard pcaps, we should also know the starting time, and can base all of our times on that. The usec field, if used as an offset instead, can give us up to 71 minutes of usec accuracy, far
  longer than an fcap file should ever last.
• The absolute max packet size should be around 19kb, so we really only need two bites for the length field.
• A typical 1 TB pcap contains about 10^6 packets per GB, so this should save us about 0.94%