To add to this, this is only evident when sniffing the network layer -- within the filtering code, it appears to think the packet is locally modified (via log statements and look at the TTL values before and after the TTL instructions).
To add to this, this is only evident when sniffing the network layer -- within the filtering code, it appears to think the packet is locally modified (via log statements and look at the TTL values before and after the TTL instructions).