Thanks for your detailed comments on that!
And yes, it felt strange to put that pcap-code in netcf_driver.c. So I
will move the code to src/util/virnetdevcapture.{c,h}, as suggested by
Daniel and rename the the functions *.capture.
Meanwhile I had written v2. The code is still in netcf_driver.c but it's
now complete (I think). I will post v3 soon.
Hendrik