More efficient to check these after established/related packets