Suricata

I dont this it is a bug

We discussed it here

https://forum.suricata.io/t/problem-with-iplen-smaller-than-hlen/6191

Attach two pcap with iplen_smaller_than_hlen error

I think one of the problem is that a broken packet is Client-hello, so tls parser cant do its job correctly

As I understend iplen_smaller_than_hlen mean

IP header Total Lenght (TL) smaller than IP header lenght

I look into RFC6274 and RFC791, this check is suggested by section 3.2. RFC6274

For obvious reasons, the Internet header cannot be larger than the
whole Internet datagram of which it is part. Therefore, the
following check should be enforced:

IHL * 4 <= Total Length

This needs to refer to the size of the datagram as specified by
the sender in the Total Length field, since link layers might have
added some padding (see Section 3.4).
If the packet does not pass this check, it should be dropped, and
this event should be logged (e.g., a counter could be incremented
reflecting the packet drop).

But it seams that some vendors dont follow this RFC (