diff --git a/lib/ff_dpdk_if.c b/lib/ff_dpdk_if.c
index 74be6f05..a06fec30 100644
--- a/lib/ff_dpdk_if.c
+++ b/lib/ff_dpdk_if.c
@@ -878,7 +878,7 @@ ff_veth_input(const struct ff_dpdk_if_context *ctx, struct rte_mbuf *pkt)
 static enum FilterReturn
 protocol_filter(const void *data, uint16_t len)
 {
-    if(len < sizeof(struct ether_hdr))
+    if(len < ETHER_HDR_LEN)
         return FILTER_UNKNOWN;
 
     const struct ether_hdr *hdr;
diff --git a/lib/ff_dpdk_kni.c b/lib/ff_dpdk_kni.c
index 2d6b323d..7e9fdfcc 100644
--- a/lib/ff_dpdk_kni.c
+++ b/lib/ff_dpdk_kni.c
@@ -258,6 +258,9 @@ protocol_filter_ip(const void *data, uint16_t len)
     hdr = (const struct ipv4_hdr *)data;
 
     int hdr_len = (hdr->version_ihl & 0x0f) << 2;
+    if (len < hdr_len)
+        return FILTER_UNKNOWN;
+
     void *next = (void *)data + hdr_len;
     uint16_t next_len = len - hdr_len;