Lastsawtime has moved further along

srcport, dstport and version are now explicitly passed as fields here, so lastsawtime is 3 fields further out.