Consider using `unshift` in either struct-compile or over-the-wire during pcap parsing

[vaguue]

https://nodejs.org/api/stream.html#readableunshiftchunk-encoding Great example, but the problem is for small pcap files the stream is gonna end right away, which can bring the same code as of now.

[vaguue]

or maybe use chevrotain