ip_len set to very large values

Question

I have a program that sets the network interface to promiscuous mode, creates a socket that receives all incoming packets, and then enters a loop to read a packet into a buffer, set a pointer to the location of the IP header, and then print the value of its ip_len field. The problem is that the printed values are impossibly high. The read() returns something like 84, and the program will print 21504. I checked the packet sizes in Wireshark, and the total size of each packet isn't very far from the return value of read(). How can I get ip_len to give me sane data?

Answer 1

It sounds like an endianness issue. 21504 is 0x5400, which byte-swapped is 0x0054 = 84. Be sure you are using ntohs(ip_len) to read the value.