--- snort-2.8.0/src/decode.c    2007-09-07 14:01:56.000000000 -0400
+++ snort-2.8.0-snaplen/src/decode.c    2007-11-21 10:20:23.000000000 -0500
@@ -2457,27 +2457,30 @@
         return;
     }
 
-    if (ip_len != len)
+    if( (ip_len != len) && (pv.pkt_snaplen != p->pkth->caplen))
     {
         if (ip_len > len) 
         {
 #ifdef DEBUG
             if (pv.verbose_flag)
                 ErrorMessage("IP Len field is %d bytes bigger"
-                        " than captured length.\n"
-                        "    (ip.len: %lu, cap.len: %lu)\n",
-                        ip_len - len, ip_len, len);
+                             " than captured length.\n"
+                             "    (ip.len: %lu, cap.len: %lu)\n",
+                             ip_len - len, ip_len, len);
 #endif
             if((runMode == MODE_IDS) && pv.decoder_flags.oversized_alert) 
             {
-                SnortEventqAdd(GENERATOR_SNORT_DECODE, DECODE_IPV4_DGRAM_GT_IPH
DR, 
-                        1, DECODE_CLASS, 3, DECODE_IPV4_DGRAM_GT_IPHDR_STR, 0);
+                SnortEventqAdd(GENERATOR_SNORT_DECODE, 
+                               DECODE_IPV4_DGRAM_GT_IPHDR, 
+                               1, DECODE_CLASS, 3, 
+                               DECODE_IPV4_DGRAM_GT_IPHDR_STR, 0);
                 if ((InlineMode()) && pv.decoder_flags.oversized_drop)
                 { 
-                    DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Dropping bad packet\
n"););
+                    DEBUG_WRAP(DebugMessage(DEBUG_DECODE, 
+                                            "Dropping bad packet\n"););
                     InlineDrop(p);
                 }
-    
+
             }
 
             p->iph = NULL;
@@ -2493,9 +2496,9 @@
 #ifdef DEBUG
             if (pv.verbose_flag)
                 ErrorMessage("IP Len field is %d bytes "
-                        "smaller than captured length.\n"
-                        "    (ip.len: %lu, cap.len: %lu)\n",
-                        len - ip_len, ip_len, len);
+                             "smaller than captured length.\n"
+                             "    (ip.len: %lu, cap.len: %lu)\n",
+                             len - ip_len, ip_len, len);
 #endif
 
         }