Talexb, thanks for the reply. Please see my other reply to keszler. The protocol and destination ports are in there b/c that's how I can pick them out. The data can follow this structure:

So, reliably picking them out can be challenging without the field names. Also, this data I'm working with doesn't always follow this format, so I'm needing to ignore the data that doesn't.