You did not include how you are getting the pcap data. Things like tcpdump use a default snaplen of something like 90. This is sometimes not even enough to capture the entire header info (like if you are in a tunnel). Your capture may not include all of the header information you are looking for.