Looks good to me. > + if (packet->size < ETH_HEADER_LEN) { In theory, I think we would want ETH_TOTAL_MIN here. However, that could potentially be annoying for it's only user ofproto/trace. So I think it's fine. Ethan