From 5b6645e09d2299f883deaa5fb5a51ebcddd62c88 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Mon, 6 Apr 2020 21:39:58 +0000
Subject: [PATCH] Copy link header from beginning of frame, not beginning of IP
 header.

---
 tcpip.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcpip.cc b/tcpip.cc
index 8f33edaee..ea9ff4a41 100644
--- a/tcpip.cc
+++ b/tcpip.cc
@@ -1612,7 +1612,7 @@ const u8 *readip_pcap(pcap_t *pd, unsigned int *len, long to_usec,
     linknfo->datalinktype = datalink;
     linknfo->headerlen = offset;
     assert(offset <= MAX_LINK_HEADERSZ);
-    memcpy(linknfo->header, p, MIN(sizeof(linknfo->header), offset));
+    memcpy(linknfo->header, p - offset, MIN(sizeof(linknfo->header), offset));
   }
   if (rcvdtime)
     PacketTrace::trace(PacketTrace::RCVD, (u8 *) p, *len,