pcap = pcap_open_dead(link, snaplen);
   /* todo: hook together argv to a single string */
   prog = argv[0];
   if (pcap_compile(pcap, &p, prog, optimize, 0) < 0) {
      fprintf(stderr, pcap_geterr(pcap));
      exit(1);
   }
   bpf_dump(&p, option);
   pcap_freecode(&p);
   pcap_close(pcap);