Wrong actually, tcp.len gives the length of tcp payload and not of the whole packet
for the whole packet lenght you need ip[2:2]. also using tcp.len gives me a parse error(??).