def parse_header(line):
    """Parse output of tcpdump of pcap file, extract:
        time
        date
        ethernet_type
        protocol
        source ip
        source port (if it exists)
        destination ip
        destination port (if it exists)
        length of the data
        resolved addresses (if they exist, for dns traffic only)
        """
    ret_dict = {}
    h = line.split()
    date = h[0]
    time = h[1]
    ret_dict['raw_header'] = line
    ret_dict['date'] = date
    ret_dict['time'] = time
    ret_dict['ethernet_type'] = h[2]

    if h[2] == 'IP6':
        """
        Conditional formatting based on ethernet type.
        IPv4 format: 0.0.0.0.port
        IPv6 format (one of many): 0:0:0:0:0:0.port
        """
        ret_dict['src_port'] = h[3].split('.')[-1]
        ret_dict['src_ip'] = h[3].split('.')[0]

        ret_dict['dest_port'] = h[5].split('.')[-1].split(':')[0]
        ret_dict['dest_ip'] = h[5].split('.')[0]
    else:
        if len(h[3].split('.')) > 4:
            ret_dict['src_port'] = h[3].split('.')[-1]
            ret_dict['src_ip'] = '.'.join(h[3].split('.')[:-1])
        else:
            ret_dict['src_ip'] = h[3]

        if len(h[5].split('.')) > 4:
            ret_dict['dest_port'] = h[5].split('.')[-1].split(':')[0]
            ret_dict['dest_ip'] = '.'.join(h[5].split('.')[:-1])
        else:
            ret_dict['dest_ip'] = h[5].split(':')[0]

    ret_dict['protocol'] = h[6]

    try:
        """
        If the packet is a DNS request or response, parse it
        correctly for length and if response from DNS server then
        parse the addresses resolved, add to list, and enter in return
        directory. 'A' if for resolved IPv4, 'AAAA' for IPv6
        """
        if ret_dict['src_port'] == '53' or ret_dict['dst_port'] == '53':
            ret_dict['length'] = int(h[-1][1:-1])
            if ret_dict['src_port'] == '53':
                resolved_addrs = []
                if ' A ' in line:
                    for addr in line.split(' A ')[1:]:
                        clean_addr = addr.replace(',', '').split()[0]
                        resolved_addrs.append(clean_addr)
                if ' AAAA ' in line:
                    for addr in line.split(' AAAA ')[1:]:
                        clean_addr = addr.replace(',', '').split()[0]
                        resolved_addrs.append(clean_addr)
                if resolved_addrs:
                    ret_dict['dns_resolved'] = resolved_addrs
    except:
        try:
            ret_dict['length'] = int(line.split(' length ')[1].split(':')[0])
        except:
            ret_dict['length'] = 0

    return ret_dict