clarified differences between ip and tcp lengths and data starts; now handles malformed packets that have more options than bytes