This is my ctypes code in Python:
class IP(Structure):
_fields_ = [
('ip_hl', c_ubyte, 4),
('ip_version', c_ubyte, 4),
('tos', c_ubyte),
('len', c_ushort),
('id', c_ushort),
('offset', c_ushort),
('ttl', c_ubyte),
('protocol_num', c_ubyte),
('sum', c_ushort),
('src', c_ulong),
('dst', c_ulong)
]
As we all know in IP Header 0-3bit is Version and 4-7bit is HeaderLength but why in this code HeaderLength is ahead of Version