update using http://www.tcpdump.org/sniffex.c