compliant with the Version 3 line format, as described in
libnetmon-format3.txt .

Note that I have made a couple small changes to the output format:
Write was renamed Send to be consistent, and I'm allowing Connected
events for UDP sockets, in the case that the application actually does
connect() the UDP socket. I'm not sure what we'd use this information
for, but it seems useful and is easy to ignore.

libnetmon is getting big enough that I should probably spend some time
soon doing code hygiene.