+ /*
+ * Sanity check: drop obviously short packets.
+ * pld_len comes from pcaphdr->len - sizeof(struct l2_header).
+ *
+ * It is assumed that the snaplen (currently hard-coded to 1000) is
+ * big enough to always capture the IP header past the L2 encap, and
+ * that pcap never truncates the packet to less than snaplen; in
+ * other words, that pcaphdr->caplen = MIN(pcaphdr->len, snaplen).
+ */
+ if (pld_len < sizeof (struct ip))
+ return;
+ if (IP_V(iptr) == 6 && pld_len < sizeof (struct ip6_hdr))
+ return;
+
+ if( (IP_V(iptr) == 4 && options.netfilter == 0)