From 6ffffd55227d83c41754f6be28deef8a73a15fd3 Mon Sep 17 00:00:00 2001
From: Scott Stafford <scott.stafford@databricks.com>
Date: Wed, 30 Jun 2021 17:00:07 -0400
Subject: [PATCH] #502 packet size either incl_len OR snaplen

---
 network/pcap.ksy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/network/pcap.ksy b/network/pcap.ksy
index 9e4c7d1e3..1060c6e42 100644
--- a/network/pcap.ksy
+++ b/network/pcap.ksy
@@ -74,7 +74,7 @@ types:
         type: u4
         doc: Length of the packet as it appeared on the network when it was captured.
       - id: body
-        size: incl_len
+        size: "incl_len < _root.hdr.snaplen ? incl_len : _root.hdr.snaplen"
         type:
           switch-on: _root.hdr.network
           cases: