sniffer headers from pcap