typos, and more rigor w.r.t. pcap overhead