pcap_open_dead(3pcap) on Linux

The text 5380be3f541e, as Debian 8 (Jessie) shipped it.

open a fake pcap_t for compiling filters or opening a capture for output

pcap_open_dead(3pcap) on Linux now