diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h
index eb17167..3956877 100644
--- a/openbsc/include/openbsc/ipaccess.h
+++ b/openbsc/include/openbsc/ipaccess.h
@@ -4,8 +4,7 @@
 #include "e1_input.h"
 
 struct ipaccess_head {
-	u_int8_t zero;
-	u_int8_t len;
+	u_int16_t len;	/* network byte order */
 	u_int8_t proto;
 	u_int8_t data[0];
 } __attribute__ ((packed));
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c
index 3882ea6..34d9462 100644
--- a/openbsc/src/input/ipaccess.c
+++ b/openbsc/src/input/ipaccess.c
@@ -259,7 +259,7 @@
 {
 	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "Abis/IP");
 	struct ipaccess_head *hh;
-	int ret = 0;
+	int len, ret = 0;
 
 	if (!msg) {
 		*error = -ENOMEM;
@@ -284,8 +284,9 @@
 
 	/* then read te length as specified in header */
 	msg->l2h = msg->data + sizeof(*hh);
-	ret = recv(bfd->fd, msg->l2h, hh->len, 0);
-	if (ret < hh->len) {
+	len = ntohs(hh->len);
+	ret = recv(bfd->fd, msg->l2h, len, 0);
+	if (ret < len) {
 		fprintf(stderr, "short read!\n");
 		msgb_free(msg);
 		*error = -EIO;
@@ -374,8 +375,7 @@
 
 	/* prepend the ip.access header */
 	hh = (struct ipaccess_head *) msgb_push(msg, sizeof(*hh));
-	hh->zero = 0;
-	hh->len = msg->len - sizeof(*hh);
+	hh->len = htons(msg->len - sizeof(*hh));
 	hh->proto = proto;
 }