Wonder if we should use PACKET_TEST_ACTION(p, ACTION_DROP) here. It checks the 'root' pkt in case of tunneled/defrag/streamend pseudo pkts.