pub fn is_dot3(buf: &[u8], offset: usize) -> bool
Check if a frame at offset is 802.3 (not Ethernet II)