That is an interesting idea.  But what does data_len correspond to - how
far does it unwrap the packet?  Is the difference constant between IPv4/6,
ARP, and any other protocols we might see on the wire?

- Jonathan Morton