diff --git a/src/Makefile.am b/src/Makefile.am
index 21f68a8096..a451b52d9f 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -15,6 +15,7 @@ decode-ppp.c decode-ppp.h \
 decode-pppoe.c decode-pppoe.h \
 decode-ipv4.c decode-ipv4.h \
 decode-ipv6.c decode-ipv6.h \
+decode-raw.c decode-raw.h \
 decode-icmpv4.c decode-icmpv4.h \
 decode-icmpv6.c decode-icmpv6.h \
 decode-tcp.c decode-tcp.h \
diff --git a/src/decode-events.h b/src/decode-events.h
index 4605aa8190..7ca811e503 100644
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -18,6 +18,7 @@ enum {
     IPV4_OPT_EOL_REQUIRED,
     IPV4_OPT_DUPLICATE,
     IPV4_OPT_UNKNOWN,
+    IPV4_WRONG_IP_VER,
 
     /* ICMP EVENTS */
     ICMPV4_PKT_TOO_SMALL,
@@ -45,6 +46,7 @@ enum {
     IPV6_EXTHDR_DUPL_EH,
 
     IPV6_EXTHDR_INVALID_OPTLEN, /* the optlen in an hop or dst hdr is invalid. */
+    IPV6_WRONG_IP_VER,
 
     /* TCP EVENTS */
     TCP_PKT_TOO_SMALL,
@@ -95,6 +97,8 @@ enum {
     GRE_VERSION1_MALFORMED_SRE_HDR,
     GRE_VERSION1_HDR_TOO_BIG,
 
+    /* RAW EVENTS */
+    IPRAW_INVALID_IPV,
 };
 
 #endif /* __DECODE_EVENTS_H__ */
diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index f957e5482a..e2208150e9 100644
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -501,6 +501,12 @@ static int DecodeIPV4Packet(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t le
         return -1;
     }
 
+    if (IP_GET_RAW_VER(pkt) != 4) {
+        SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt));
+        DECODER_SET_EVENT(p,IPV4_WRONG_IP_VER);
+        return -1;
+    }
+
     p->ip4h = (IPV4Hdr *)pkt;
 
     if (IPV4_GET_HLEN(p) < IPV4_HEADER_LEN) {
diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index 2ac05ff5ad..57410ae857 100644
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -348,6 +348,12 @@ static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, u
         return -1;
     }
 
+    if (IP_GET_RAW_VER(pkt) != 6) {
+        SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt));
+        DECODER_SET_EVENT(p,IPV6_WRONG_IP_VER);
+        return -1;
+    }
+
     p->ip6h = (IPV6Hdr *)pkt;
 
     if (len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p)))
diff --git a/src/decode-raw.c b/src/decode-raw.c
new file mode 100644
index 0000000000..090d5dad4f
--- /dev/null
+++ b/src/decode-raw.c
@@ -0,0 +1,156 @@
+/* Copyright (c) 2009 Open Information Security Foundation */
+
+/** \file
+ *  \author William Metcalf <william.metcalf@gmail.com>
+ */
+
+#include "suricata-common.h"
+#include "decode.h"
+#include "decode-raw.h"
+#include "decode-events.h"
+
+#include "util-unittest.h"
+#include "util-debug.h"
+
+void DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
+{
+    SCPerfCounterIncr(dtv->counter_raw, tv->sc_perf_pca);
+
+    /* If it is ipv4 or ipv6 it should at least be the size of ipv4 */
+    if (len < IPV4_HEADER_LEN) {
+        DECODER_SET_EVENT(p,IPV4_PKT_TOO_SMALL);
+        return;
+    }
+
+    if (IP_GET_RAW_VER(pkt) == 4) {
+        SCLogDebug("IPV4 Packet");
+        DecodeIPV4(tv, dtv, p, p->pkt, p->pktlen, pq);
+    } else if (IP_GET_RAW_VER(pkt) == 6) {
+        SCLogDebug("IPV6 Packet");
+        DecodeIPV6(tv, dtv, p, p->pkt, p->pktlen, pq);
+    } else {
+        SCLogDebug("Unknown ip version %" PRIu8 "", IP_GET_RAW_VER(pkt));
+        DECODER_SET_EVENT(p,IPRAW_INVALID_IPV);
+    }
+    return;
+}
+
+#ifdef UNITTESTS
+/** DecodeRawtest01
+ *  \brief Valid Raw packet
+ *  \retval 0 Expected test value
+ */
+static int DecodeRawTest01 (void)   {
+
+    /* IPV6/TCP/no eth header */
+    uint8_t raw_ip[] = {
+        0xff, 0x00, 0xac, 0x83, 0xfd, 0xcf, 0xea, 0x6a,
+        0x24, 0xfb, 0x91, 0xff, 0x00, 0xbd, 0x45, 0x14,
+        0xca, 0x8f, 0x51, 0xf7, 0x1f, 0xeb, 0x6e, 0x3f,
+        0xdf, 0x3f, 0xd2, 0x9d, 0x65, 0xfe, 0xbd, 0x7f,
+        0xeb, 0x89, 0xff, 0x00, 0xd0, 0x4d, 0x14, 0x54,
+        0xad, 0x83, 0xa9, 0x0f, 0x65, 0xfa, 0xd2, 0x93,
+        0xfb, 0x8b, 0x9f, 0xaa, 0xff, 0x00, 0xec, 0xd4,
+        0x51, 0x43, 0x1a, 0x12, 0x4f, 0xf5, 0xaf, 0xff,
+        0x00, 0x5c, 0xea, 0x2a, 0x28, 0xa6, 0x89, 0x67,
+        0xff, 0xd9 };
+
+    Packet p;
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&tv,  0, sizeof(ThreadVars));
+    memset(&p,   0, sizeof(Packet));
+
+    DecodeRaw(&tv, &dtv, &p, raw_ip, sizeof(raw_ip), NULL);
+    if (p.ip6h == NULL) {
+        printf("expected a valid ipv6 header but it was NULL");
+        return 0;
+    }
+
+    return 1;
+
+}
+/** DecodeRawtest02
+ *  \brief Valid Raw packet
+ *  \retval 0 Expected test value
+ */
+static int DecodeRawTest02 (void)   {
+
+    /* IPV4/TCP/no eth header */
+    uint8_t raw_ip[] = {
+        0x47, 0x45, 0x54, 0x20, 0x2f, 0x2f, 0x72, 0x6f,
+        0x75, 0x6e, 0x64, 0x31, 0x37, 0x39, 0x2e, 0x78,
+        0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f,
+        0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x43, 0x6f, 0x6e,
+        0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a,
+        0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c,
+        0x69, 0x76, 0x65, 0x0d, 0x0a, 0x48, 0x6f, 0x73,
+        0x74, 0x3a, 0x20, 0x31, 0x39, 0x32, 0x2e, 0x31,
+        0x36, 0x38, 0x2e, 0x31, 0x30, 0x32, 0x2e, 0x32,
+        0x0d, 0x0a, 0x0d, 0x0a };
+
+    Packet p;
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&tv,  0, sizeof(ThreadVars));
+    memset(&p,   0, sizeof(Packet));
+
+    DecodeRaw(&tv, &dtv, &p, raw_ip, sizeof(raw_ip), NULL);
+    if (p.ip4h == NULL) {
+        printf("expected a valid ipv4 header but it was NULL");
+        return 0;
+    }
+
+    return 1;
+}
+/** DecodeRawtest03
+ *  \brief Valid Raw packet
+ *  \retval 0 Expected test value
+ */
+static int DecodeRawTest03 (void)   {
+
+    /* IPV13 */
+    uint8_t raw_ip[] = {
+        0xdf, 0x00, 0x00, 0x3d, 0x49, 0x42, 0x40, 0x00,
+        0x40, 0x06, 0xcf, 0x8a, 0x0a, 0x1f, 0x03, 0xaf,
+        0x0a, 0x1f, 0x0a, 0x02, 0xa5, 0xe7, 0xde, 0xad,
+        0x00, 0x0c, 0xe2, 0x0e, 0x8b, 0xfe, 0x0c, 0xe7,
+        0x80, 0x18, 0x00, 0xb7, 0xaf, 0xeb, 0x00, 0x00,
+        0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xab, 0x4f,
+        0x34, 0x40, 0x67, 0x31, 0x3b, 0x63, 0x61, 0x74,
+        0x20, 0x6b, 0x65, 0x79, 0x3b };
+
+    Packet p;
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&tv,  0, sizeof(ThreadVars));
+    memset(&p,   0, sizeof(Packet));
+
+    DecodeRaw(&tv, &dtv, &p, raw_ip, sizeof(raw_ip), NULL);
+    if (DECODER_ISSET_EVENT(&p,IPRAW_INVALID_IPV)) {
+        return 0;
+    } else {
+        printf("expected IPRAW_INVALID_IPV to be set but it wasn't");
+    }
+    return 1;
+}
+
+#endif /* UNITTESTS */
+
+/**
+ * \brief Registers Raw unit tests
+ * \todo More Raw tests
+ */
+void DecodeRawRegisterTests(void) {
+#ifdef UNITTESTS
+    UtRegisterTest("DecodeRawTest01", DecodeRawTest01, 0);
+    UtRegisterTest("DecodeRawTest02", DecodeRawTest02, 0);
+    UtRegisterTest("DecodeRawTest03", DecodeRawTest03, 0);
+#endif /* UNITTESTS */
+}
diff --git a/src/decode-raw.h b/src/decode-raw.h
new file mode 100644
index 0000000000..b53e5422c2
--- /dev/null
+++ b/src/decode-raw.h
@@ -0,0 +1,11 @@
+/* Copyright (c) 2009 Open Information Security Foundation */
+
+/** \file
+ *  \author William Metcalf <william.metcalf@gmail.com>
+ */
+
+#ifndef __DECODE_RAW_H__
+#define __DECODE_RAW_H__
+void DecodeRawRegisterTests(void);
+#endif /* __DECODE_RAW_H__ */
+
diff --git a/src/decode.c b/src/decode.c
index 39ac95317f..99ef9e3254 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -64,6 +64,8 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
                                                 SC_PERF_TYPE_UINT64, "NULL");
     dtv->counter_eth = SCPerfTVRegisterCounter("decoder.ethernet", tv,
                                                SC_PERF_TYPE_UINT64, "NULL");
+    dtv->counter_raw = SCPerfTVRegisterCounter("decoder.raw", tv,
+                                               SC_PERF_TYPE_UINT64, "NULL");
     dtv->counter_sll = SCPerfTVRegisterCounter("decoder.sll", tv,
                                                SC_PERF_TYPE_UINT64, "NULL");
     dtv->counter_tcp = SCPerfTVRegisterCounter("decoder.tcp", tv,
diff --git a/src/decode.h b/src/decode.h
index 24e36048be..26418ee09d 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -31,6 +31,7 @@
 #include "decode-icmpv6.h"
 #include "decode-tcp.h"
 #include "decode-udp.h"
+#include "decode-raw.h"
 
 /* Address */
 typedef struct Address_
@@ -140,6 +141,10 @@ typedef uint16_t Port;
 #define CMP_PORT(p1,p2) \
     ((p1 == p2))
 
+/*Given a packet pkt offset to the start of the ip header in a packet
+ *We determine the ip version. */
+#define IP_GET_RAW_VER(pkt) (((pkt[0] & 0xf0) >> 4))
+
 #define PKT_IS_IPV4(p)      (((p)->ip4h != NULL))
 #define PKT_IS_IPV6(p)      (((p)->ip6h != NULL))
 #define PKT_IS_TCP(p)       (((p)->tcph != NULL))
@@ -334,6 +339,7 @@ typedef struct DecodeThreadVars_
     uint16_t counter_ipv6;
     uint16_t counter_eth;
     uint16_t counter_sll;
+    uint16_t counter_raw;
     uint16_t counter_tcp;
     uint16_t counter_udp;
     uint16_t counter_icmpv4;
@@ -443,6 +449,7 @@ void DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t,
 void DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
 void DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
 void DecodeTunnel(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
+void DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
 void DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
 void DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
 void DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
@@ -488,7 +495,7 @@ inline void DecodeSetNoPacketInspectionFlag(Packet *);
 #define LINKTYPE_ETHERNET   DLT_EN10MB
 #define LINKTYPE_LINUX_SLL  113
 #define LINKTYPE_PPP        9
-
+#define LINKTYPE_RAW        DLT_RAW
 #define PPP_OVER_GRE        11
 
 /*Packet Flags*/
diff --git a/src/detect-decode-event.h b/src/detect-decode-event.h
index c15506806d..74a658c59b 100644
--- a/src/detect-decode-event.h
+++ b/src/detect-decode-event.h
@@ -33,6 +33,7 @@ struct DetectDecodeEvents_ {
     { "ipv4.opt_eol_required", IPV4_OPT_EOL_REQUIRED, },
     { "ipv4.opt_duplicate", IPV4_OPT_DUPLICATE, },
     { "ipv4.opt_unknown", IPV4_OPT_UNKNOWN, },
+    { "ipv4.wrong_ip_version", IPV4_WRONG_IP_VER, },
     { "ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL, },
     { "ipv6.trunc_pkt", IPV6_TRUNC_PKT, },
     { "ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR, },
@@ -43,6 +44,7 @@ struct DetectDecodeEvents_ {
     { "ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, },
     { "ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, },
     { "ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, },
+    { "ipv4.wrong_ip_version", IPV4_WRONG_IP_VER, },
     { "icmpv6.unknown_type", ICMPV6_UNKNOWN_TYPE,},
     { "icmpv6.unknown_code", ICMPV6_UNKNOWN_CODE,},
     { "icmpv6.pkt_too_small", ICMPV6_PKT_TOO_SMALL,},
@@ -78,6 +80,7 @@ struct DetectDecodeEvents_ {
     { "gre.version1_wrong_protocol", GRE_VERSION1_WRONG_PROTOCOL, },
     { "gre.version1_malformed_sre_hdr", GRE_VERSION1_MALFORMED_SRE_HDR, },
     { "gre.version1_hdr_too_big", GRE_VERSION1_HDR_TOO_BIG, },
+    { "ipraw.wrong_ip_version",IPRAW_INVALID_IPV, },
     { NULL, 0 },
 };
 #endif /* DETECT_EVENTS */
diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index f6053f42d7..8ffa75bcb4 100644
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -144,6 +144,10 @@ TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data) {
         case LINKTYPE_PPP:
             pcap_g.Decoder = DecodePPP;
             break;
+        case LINKTYPE_RAW:
+            pcap_g.Decoder = DecodeRaw;
+            break;
+
         default:
             printf("Error: datalink type %" PRId32 " not yet supported in module PcapFile.\n", pcap_g.datalink);
             return TM_ECODE_FAILED;
diff --git a/src/source-pcap.c b/src/source-pcap.c
index e4ccf6d8c4..693ca0248c 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -311,6 +311,9 @@ TmEcode DecodePcap(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq)
         case LINKTYPE_PPP:
             DecodePPP(tv, dtv, p, p->pkt, p->pktlen, pq);
             break;
+        case LINKTYPE_RAW:
+            DecodeRaw(tv, dtv, p, p->pkt, p->pktlen, pq);
+            break;
         default:
             printf("Error: datalink type %" PRId32 " not yet supported in module DecodePcap.\n", p->datalink);
             break;
diff --git a/src/suricata.c b/src/suricata.c
index a94038a822..d0c03bd548 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -569,6 +569,7 @@ int main(int argc, char **argv)
         SMBParserRegisterTests();
         DCERPCParserRegisterTests();
         FTPParserRegisterTests();
+        DecodeRawRegisterTests();
         DecodePPPOERegisterTests();
         DecodeICMPV4RegisterTests();
         DecodeICMPV6RegisterTests();