length module documentation mismatch
In iptables-extension man page, it says length module matches the payload of L3. but xt_length.c matches the total length of IPv4/v6 packet.
Quoted 1 line
u_int16_t pktlen = ntohs(ip_hdr(skb)->tot_len);
http://git.netfilter.org/iptables/tree/extensions/libxt_length.man
Quoted 1 line
This module matches the length of the layer-3 payload (e.g. layer-4 packet)
should have been, perhaps,
Quoted 1 line
This module matches the length of the layer-3 packet (e.g. layer-2 payload)