On Sep 8, 2010, at 8:47 AM, Petr Sumbera wrote:
> But the problem is that stored packets for *outgoing* traffic doesn't
> contain "Header length" (it's zero as at layer where it was captured it
> wasn't filled,
...which means, of course, that no outgoing IPv4 traffic *ever* has IP options.
Otherwise, outgoing IPv4 packets would be undissectable unless the IPv4 header length is available elsewhere; you cannot dissect an IPv4 header unless you know how big it is, as it's not fixed-length (it's a fixed-length 20-byte portion followed by 0 or more bytes of options).
