extract ip_hl and th_off