diff --git a/tcpip.cc b/tcpip.cc
index 8f33edaee..ea9ff4a41 100644
--- a/tcpip.cc
+++ b/tcpip.cc
@@ -1612,7 +1612,7 @@ const u8 *readip_pcap(pcap_t *pd, unsigned int *len, long to_usec,
     linknfo->datalinktype = datalink;
     linknfo->headerlen = offset;
     assert(offset <= MAX_LINK_HEADERSZ);
-    memcpy(linknfo->header, p, MIN(sizeof(linknfo->header), offset));
+    memcpy(linknfo->header, p - offset, MIN(sizeof(linknfo->header), offset));
   }
   if (rcvdtime)
     PacketTrace::trace(PacketTrace::RCVD, (u8 *) p, *len,