string match fails to find anything/everything

[gypsy <gypsy@iswest.com>]

Facts:
iptables 1.2.9 built against kernel v 2.4.25 or .26 depending on which
computer.
kernel 2.4.26
os fingerprinting only works on the internal interface,  not eth1.
"tcpdump -n -i eth1 -w /tmp/dump" clearly shows the text I am attempting
to match.
I have a test bed with very little traffic so that using a string match
will not bog down.
Repeats on 3 different computers all running Slackware 9.1.
Several other POM / POM-NG modules are installed.

Problem:
No matter what text is in $STRING, iptables fails to see the match.

iptables -I INPUT -m string --string $STRING -j LOG

"iptables -nvL | grep STRING" has zeros in the counters.

Example:
Replace $STRING with "oreilly".  From a remote computer run "lynx
http://myurl/oreilly" and variants until at least 30 pages have been
displayed to be certain that at least one packet is not so fragmented
that "oreilly" isn't there (see also Facts above).  On the "myurl"
computer iptables counters are zero.

QUESTION:
How can I find out why the string match fails to find the intended
text?  (Later on I may ask how to fix that...)

gypsy