code: @Override
      public boolean accept(final Buffer buffer) throws IOException {
          buffer.markReaderIndex();
          try {
              final Buffer test = buffer.readBytes(16);
              final byte b1 = test.getByte(0);
              final byte b2 = test.getByte(1);
              final byte b14 = test.getByte(14);
              final byte b15 = test.getByte(15);
              return validatePacketType(b1, b2) && isKnownEtherType(b14, b15);
          } catch (final IndexOutOfBoundsException e) {
              return false;
          } finally {
              buffer.resetReaderIndex();
          }
      }
docs: (taken from pcap/sll.sh)
  
  For captures on Linux cooked sockets, we construct a fake header that
  includes:
  
  a 2-byte "packet type" which is one of:
  
  LINUX_SLL_HOST packet was sent to us LINUX_SLL_BROADCAST packet was
  broadcast LINUX_SLL_MULTICAST packet was multicast LINUX_SLL_OTHERHOST
  packet was sent to somebody else LINUX_SLL_OUTGOING packet was sent *by*
  us;
  
  a 2-byte Ethernet protocol field;
  
  a 2-byte link-layer type;
  
  a 2-byte link-layer address length;
  
  an 8-byte source link-layer address, whose actual length is specified by
  the previous value.
  
  All fields except for the link-layer address are in network byte order.
  
  DO NOT change the layout of this structure, or change any of the
  LINUX_SLL_ values below. If you must change the link-layer header for a
  "cooked" Linux capture, introduce a new DLT_ type (ask
  "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it a
  value that collides with a value already being used), and use the new
  header in captures of that type, so that programs that can handle
  DLT_LINUX_SLL captures will continue to handle them correctly without any
  change, and so that capture files with different headers can be told
  apart and programs that read them can dissect the packets in them.
  
  
  {@inheritDoc}