rewritten wireshark patch