Hi The network-data (version 0.0.2) [1] contains the module Data.IP. This modules encapsulates IPv4 headers. The Data.IP modules contains the type IPv4Header: data IPv4Header = IPv4Hdr { hdrLength :: Int , version :: Int , tos :: Int , payloadLength :: Int ... The code to turn IPv4 packages into IPv4Heder looks like [2]: instance Binary IPv4Header where put (IPv4Hdr ihl ver tos len id flags off ttl prot csum src dst) = do pW8 $ (ihl .&. 0xF) .|. (ver `shiftL` 4 .&. 0xF0) pW8 tos pW16 len pW16 id let offFlags = (off .&. 0x1FFF) .|. fromIntegral (fromEnum flags `shiftL` 13) pW16 offFlags pW8 ttl pW8 prot put csum put src put dst That is, the payload length is the 16-31'th bit of the IPv4 header. This field is according to [3] and [4] referred to as "total length" - not "payload length". The total length include both the length of the data and the header. When I read the term "payload length" I first thought it referred to the length of the package excluding the header. So I am right to see this as a bug in network-data ? Regards, Mads Lindstrøm [1] http://hackage.haskell.org/package/network-data [2] http://hackage.haskell.org/packages/archive/network-data/0.0.2/doc/html/src/... [3] http://tools.ietf.org/html/rfc791 [4] http://en.wikipedia.org/wiki/IPv4#Header