On Oct 15, 2012, at 5:13 PM, Perry Smith <pedzsan@xxxxxxxxx> wrote:
> I'm wondering if maybe the iptrace format doesn't have both fields.
From what we've been able to determine, it doesn't. There *are* some fields in the iptrace per-packet header that we haven't figured out yet; I don't know whether one of them happens to be the length of the packet on the wire or not - if you could supply us with one of those captures, we could try to see whether the length on the wire is in one of those fields.
