diff --git a/net/lux_packet.go b/net/lux_packet.go
index 2222ebd..9cabb0c 100644
--- a/net/lux_packet.go
+++ b/net/lux_packet.go
@@ -5,6 +5,7 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"errors"
+	"log"
 	"lux/crypto"
 	"lux/proto"
 	"net"
@@ -12,11 +13,15 @@ import (
 
 const LUX_PROTO_PACKET_HDRLEN = proto.LUX_PROTO_ID_SIZE + 2
 
+// Target, Type are decoded from header
+// Buffer contains LuxBuffer with stripped headers
+// NOTE: Packets are always padded, so payloads may be
+// bigger than expected and contain trailing bytes
 type LuxPacket struct {
-	ChannelType LuxChannelType
 	Target      proto.LuxID
 	Type        uint
 	Buffer      proto.LuxBuffer
+	ChannelType LuxChannelType
 }
 
 func DecryptLuxPacket(dgram LuxDatagram, key crypto.LuxKey) (LuxPacket, error) {
@@ -48,6 +53,13 @@ func DecryptLuxPacket(dgram LuxDatagram, key crypto.LuxKey) (LuxPacket, error) {
 		return packet, err
 	}
 
+	data, err := packet.Buffer.ReadNext(packet.Buffer.Remaining())
+	if err != nil {
+		return packet, err
+	}
+
+	// strip lux packet headers from payload, as well as padding
+	packet.Buffer = proto.FromSlice(data)
 	return packet, nil
 }
 
@@ -61,9 +73,11 @@ func EncryptLuxPacket(packet LuxPacket, key crypto.LuxKey, target *net.UDPAddr)
 	encrypter := cipher.NewCBCEncrypter(cipherBlock, key.IV)
 
 	var paddingLen int
-	packetLen := packet.Buffer.Length()
+	packetLen := LUX_PROTO_PACKET_HDRLEN + packet.Buffer.Length()
 	if packetLen%encrypter.BlockSize() != 0 {
-		paddingLen = ((packetLen / encrypter.BlockSize()) + 1) * encrypter.BlockSize()
+		//paddingLen = ((packetLen / encrypter.BlockSize()) + 1) * encrypter.BlockSize()
+		paddingLen = encrypter.BlockSize() - (packetLen % encrypter.BlockSize())
+		log.Default().Print(packetLen, paddingLen)
 	} else {
 		paddingLen = 0
 	}
@@ -74,7 +88,7 @@ func EncryptLuxPacket(packet LuxPacket, key crypto.LuxKey, target *net.UDPAddr)
 		return dgram, err
 	}
 
-	wd := proto.AllocLuxBuffer(LUX_PROTO_PACKET_HDRLEN + packetLen + paddingLen)
+	wd := proto.AllocLuxBuffer(packetLen + paddingLen)
 	key.Id.Write(&wd)
 	wd.WriteUint16(uint16(packet.Type))
 	wd.WriteBytes(packet.Buffer.AllBytes())
diff --git a/tests/lux_router_test.go b/tests/lux_router_test.go
index 2e16634..861100e 100644
--- a/tests/lux_router_test.go
+++ b/tests/lux_router_test.go
@@ -88,9 +88,13 @@ func TestRouterSendRecv(t *testing.T) {
 	if newPacket.Type != packet.Type {
 		t.Fatal("newPacket.Type != packet.Type")
 	}
-	if !bytes.Equal(newPacket.Buffer.AllBytes(), payload) {
+	if newPayload, _ := newPacket.Buffer.ReadNext(8); !bytes.Equal(newPayload, payload) {
 		t.Log(payload)
 		t.Log(newPacket.Buffer.AllBytes())
 		t.Fatal("payloads aren't equal!")
 	}
+
+	if len(routerA.GetRoutes()) != 1 {
+		t.Fatal("routerA does not contain new inbound route")
+	}
 }