Suricata

Calculation uses sizeof(struct pcap_pktdir), which gives 24 on linux. However on apple, it gives 280.

struct pcap_pkthdr {
        struct timeval ts;      /* time stamp */ 
        bpf_u_int32 caplen;     /* length of portion present */
        bpf_u_int32 len;        /* length of this packet (off wire) */
#ifdef __APPLE__ 
        char comment[256];
#endif
};

No comment.