add checks for netfilter's headers