[Guy Harris <guy@xxxxxxxxxxxx>]

HPfrommer@xxxxxxxxxxxx wrote:

> I've seen that the pcap packet header contains a field "Interface ID"

The pcap packet header, as defined by libpcap from tcpdump.org (which is 
the closest thing to an official pcap header definition that exists), has:

	a time stamp, with seconds and microseconds;

	an on-the-wire length;

	a captured length;

and that's it.  No interface ID.

The pcap-NG packet header has an interface ID, but pcap-NG isn't pcap.