only allow sane packets through z3