The rule is to always update them to the full packet size minus UDP/IP encapsulation for all authenticated packet types.