I have a packet filter that operates on AH-encapsulated UDP packets, and while tcpdump shows the AH header is there, it 
is not available when my packet filter hook is called (at least, it isn't as far as I can tell.  The source and 
destination are correct, but the ip_p field in the iphdr is only ever IPPROTO_UDP). I thought maybe something above my 
hook in the stack was de-encapsulating the packet, but I haven't been able to find a way to test this. Any thoughts on 
where I should look, or other possible causes?