diff --git a/src/internal/rewrite/packet.go b/src/internal/rewrite/packet.go
index 20b66c8..5e0a33d 100644
--- a/src/internal/rewrite/packet.go
+++ b/src/internal/rewrite/packet.go
@@ -120,6 +120,11 @@ func (r *Rewriter) RewritePacketUserAgent(payload []byte, srcAddr, dstAddr strin
 
 // RewriteTCP rewrites the TCP packet's User-Agent if applicable
 func (r *Rewriter) RewriteTCP(tcp *layers.TCP, srcAddr, dstAddr string) *RewriteResult {
+	if len(tcp.Payload) == 0 {
+		return &RewriteResult{
+			Modified: false,
+		}
+	}
 	hasUA, modified, skip := r.RewritePacketUserAgent(tcp.Payload, srcAddr, dstAddr)
 	return &RewriteResult{
 		Modified: modified,
diff --git a/src/internal/server/nfqueue/nfqueue_linux.go b/src/internal/server/nfqueue/nfqueue_linux.go
index 2a96456..5955afa 100644
--- a/src/internal/server/nfqueue/nfqueue_linux.go
+++ b/src/internal/server/nfqueue/nfqueue_linux.go
@@ -81,7 +81,7 @@ func (s *Server) Close() error {
 
 // handlePacket processes a single NFQUEUE packet
 func (s *Server) handlePacket(packet *base.Packet) {
-	if s.Cfg.RewriteMode == config.RewriteModeDirect || packet.TCP == nil || len(packet.TCP.Payload) == 0 {
+	if s.Cfg.RewriteMode == config.RewriteModeDirect || packet.TCP == nil {
 		_ = s.nfqServer.Nf.SetVerdict(*packet.A.PacketID, nfq.NfAccept)
 		return
 	}