That is an interesting idea.  But what does data_len correspond to - how far does it unwrap the packet?  Is the difference constant between IPv4/6, ARP, and any other protocols we might see on the wire?

- Jonathan Morton