Might I propose an alternate approach? We keep the "--length m:n" option as is and add a tcp-flags-like list of which objects make up the final size to compare against: --length-of IP PROTO PAYLOAD or --length-of ALL would match the entire packet, and be the default if not specified so the length module wouldn't change its actions. This would be the equivalent of your --length-raw, I think. --length-of PAYLOAD would give me the payload size I need. (like your --length-payload). --length-of IP would allow matching just the IP header, giving an alternate test for IP options with "--length 21:". This matches your --length-ipv4, if I understand you. I tend to prefer "IP" instead of "IPV4", but don't care too much either way. --length-of PROTO would allow testing for the length of just the protocol header. with -p tcp, this would give an alternate test for tcp options too. --length-of HEADERS HEADERS would be a macro for IP+PROTO (as ALL is a macro for the entire packet). I think we could skip the NONE option. ;-) --length-of SOME_MACRO_NAME would match the PROTO + PAYLOAD. Any suggestions for a good macro name? I'm not claiming that all the above combinations are useful (NONE? "IP PAYLOAD"?), but this gives a little flexibility to those that need it and with carefully chosen macros, not a lot of extra work or typing. I'd recommend against trying to break it up into IP IP-OPTIONS PROTO PROTO-OPTIONS and PAYLOAD; anyone wanting to test for one of the options fields can add 20 to the desired number. Since one can express all combinations with postive logic, I don't see a need for "!" negation in this parameter.