The text 55504038ed65, as Debian 7 (Wheezy) shipped it.
get the file descriptor for a live capture
pcap_fileno(3pcap) on Linux now
