+ the header file contains two different opcodes (O_IPOPTS and O_IPOPT)
  for what is the same thing, and sure enough i used one in the kernel
  and the other one in userland. Be consistent!

+ "keep-state" and "limit" must be the last match pattern in a rule,
  so no matter how you enter them move them to the end of the rule.