diff --git a/router/fastdp.go b/router/fastdp.go
index 5f2a101b..a25df7d4 100644
--- a/router/fastdp.go
+++ b/router/fastdp.go
@@ -694,10 +694,12 @@ func (fwd *fastDatapathForwarder) Confirm() {
 
 	fwd.lock.Unlock() // unlock before calling send() which may block
 
-	if err := fwd.sendControlMsg(FastDatapathCryptoInitSARemote, controlMsg); err != nil {
-		log.Error(fwd.logPrefix(), "ipsec send InitSARemote failed: ", err)
-		fwd.handleError(err)
-		return
+	if len(controlMsg) > 0 {
+		if err := fwd.sendControlMsg(FastDatapathCryptoInitSARemote, controlMsg); err != nil {
+			log.Error(fwd.logPrefix(), "ipsec send InitSARemote failed: ", err)
+			fwd.handleError(err)
+			return
+		}
 	}
 
 	go fwd.doHeartbeats()
diff --git a/router/pcap.go b/router/pcap.go
index db1048c2..c4859277 100644
--- a/router/pcap.go
+++ b/router/pcap.go
@@ -4,10 +4,14 @@ import (
 	"fmt"
 	"net"
 	"sync"
+	"time"
 
 	"github.com/google/gopacket/pcap"
 )
 
+// Must be less than 2^31 usec - see https://github.com/google/gopacket/issues/708
+const longTimeout = time.Duration(30 * time.Minute)
+
 type Pcap struct {
 	NonDiscardingFlowOp
 
@@ -77,7 +81,7 @@ func newPcapHandle(ifName string, promisc bool, snaplen int, bufSz int) (handle
 	if err = inactive.SetSnapLen(snaplen); err != nil {
 		return
 	}
-	if err = inactive.SetTimeout(MaxDuration); err != nil {
+	if err = inactive.SetTimeout(longTimeout); err != nil {
 		return
 	}
 	if err = inactive.SetImmediateMode(true); err != nil {