Allow extended filters

[tlnd]

As tshark is used now, extended filter syntax can be used (tshark read filter). It should be allowed to pass an extended filter as option to the container in addition to the pcap filter. The pcap filter should always be applied for efficiency. The extended filter should only apply if given as argument.

[wfailla]

tshark does not allow for wireshark like filters to be applied to a capture stream. And the functionality of piping to a tshark and than applying a read filter is also broken (see https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234) this feature will be placed on hold.

To use wireshark like filter syntax capture some files and use the tshark (provided in the docker-pcap container) to filter all packages in that file again:

-> % docker run --net=host -v $PWD/dump:/data --rm -ti travelping/pcap /bin/sh
/ # tshark -r /path/to/file -Y <filter>

The documentation will be updated soon to include this.