diff --git a/CHANGES b/CHANGES
index 092a5b3740..1285b53cf8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 
-2.0-85 | 2012-02-17 15:36:12 -0800
+2.0-86 | 2012-02-17 15:41:06 -0800
 
   * Changing ARP detection to always kick in even if no analyzer is
     activated. (Robin Sommer)
diff --git a/VERSION b/VERSION
index 0e3b680daa..2436939ed7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.0-85
+2.0-86
diff --git a/src/PktSrc.cc b/src/PktSrc.cc
index 598f13b51c..68b9785e6f 100644
--- a/src/PktSrc.cc
+++ b/src/PktSrc.cc
@@ -191,7 +191,7 @@ void PktSrc::Process()
 	switch ( datalink ) {
 	case DLT_NULL:
 		{
-		protocol = (data[0] << 24) + (data[1] << 16) + (data[2] << 8) + data[3];
+		protocol = (data[3] << 24) + (data[2] << 16) + (data[1] << 8) + data[0];
 
 		if ( protocol != AF_INET && protocol != AF_INET6 )
 			{