diff --git a/src/packet_analysis/protocol/icmp/ICMP.cc b/src/packet_analysis/protocol/icmp/ICMP.cc
index 80878c8400..a99fbb2d03 100644
--- a/src/packet_analysis/protocol/icmp/ICMP.cc
+++ b/src/packet_analysis/protocol/icmp/ICMP.cc
@@ -112,11 +112,11 @@ void ICMPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int rema
     // handling those properly.
     pkt->session = c;
 
-    ForwardPacket(std::min(len, remaining), data, pkt);
-
-    // Tap the packet before sending it to protocol analysis.
+    // Tap the packet before processing/forwarding.
     adapter->TapPacket(pkt);
 
+    ForwardPacket(std::min(len, remaining), data, pkt);
+
     if ( remaining >= len )
         adapter->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
 
diff --git a/src/packet_analysis/protocol/tcp/TCP.cc b/src/packet_analysis/protocol/tcp/TCP.cc
index da5496efad..ef0e4b19b6 100644
--- a/src/packet_analysis/protocol/tcp/TCP.cc
+++ b/src/packet_analysis/protocol/tcp/TCP.cc
@@ -103,18 +103,18 @@ void TCPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
         return;
     }
 
-    adapter->Process(is_orig, tp, len, ip, data, remaining);
-
     // Store the session in the packet in case we get an encapsulation here. We need it for
     // handling those properly.
     pkt->session = c;
 
+    // Tap the packet before processing/forwarding.
+    adapter->TapPacket(pkt);
+
+    adapter->Process(is_orig, tp, len, ip, data, remaining);
+
     // Send the packet back into the packet analysis framework.
     ForwardPacket(std::min(len, remaining), data, pkt);
 
-    // Tap the packet before sending it to session analysis.
-    adapter->TapPacket(pkt);
-
     // Call DeliverPacket on the adapter directly here. Normally we'd call ForwardPacket
     // but this adapter does some other things in its DeliverPacket with the packet children
     // analyzers.
diff --git a/src/packet_analysis/protocol/udp/UDP.cc b/src/packet_analysis/protocol/udp/UDP.cc
index 82cea42534..309aa28814 100644
--- a/src/packet_analysis/protocol/udp/UDP.cc
+++ b/src/packet_analysis/protocol/udp/UDP.cc
@@ -190,15 +190,15 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
     // handling those properly.
     pkt->session = c;
 
+    // Tap the packet before processing/forwarding.
+    adapter->TapPacket(pkt);
+
     // Send the packet back into the packet analysis framework. We only check the response
     // port here because the orig/resp should have already swapped around based on
     // likely_server_ports. This also prevents us from processing things twice if protocol
     // detection has to be used.
     ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort()));
 
-    // Tap the packet before sending it to session analysis.
-    adapter->TapPacket(pkt);
-
     // Forward any data through session-analysis, too.
     adapter->ForwardPacket(std::min(len, remaining), data, is_orig, -1, ip.get(), pkt->cap_len);
 }