Remember to subtract the TCP header length. Signed-off-by: Duncan Roe <duncan_roe@xxxxxxxxxxxxxxx> --- src/extra/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/extra/tcp.c b/src/extra/tcp.c index 0f83500..236663f 100644 --- a/src/extra/tcp.c +++ b/src/extra/tcp.c @@ -83,7 +83,7 @@ void *nfq_tcp_get_payload(struct tcphdr *tcph, struct pkt_buff *pktb) EXPORT_SYMBOL unsigned int nfq_tcp_get_payload_len(struct tcphdr *tcph, struct pkt_buff *pktb) { - return pktb->tail - pktb->transport_header; + return pktb->tail - pktb->transport_header -tcph->doff * 4; } /** -- 2.14.5