diff --git a/TargetGroup.cc b/TargetGroup.cc
index d4712348e..bc6235fd0 100644
--- a/TargetGroup.cc
+++ b/TargetGroup.cc
@@ -171,7 +171,7 @@ static char *split_netmask(const char *expr, int *bits) {
   slash = strrchr(expr, '/');
   if (slash != NULL) {
     long l;
-    char *tail;
+    const char *tail;
 
     l = parse_long(slash + 1, &tail);
     if (tail == slash + 1 || *tail != '\0' || l < 0 || l > INT_MAX)
@@ -203,7 +203,7 @@ static int parse_ipv4_ranges(octet_bitvector octets[4], const char *spec) {
     } else {
       for (;;) {
         long start, end;
-        char *tail;
+        const char *tail;
 
         errno = 0;
         start = parse_long(p, &tail);
diff --git a/nbase/nbase.h b/nbase/nbase.h
index 2c80d740b..bf20c9a2c 100644
--- a/nbase/nbase.h
+++ b/nbase/nbase.h
@@ -435,7 +435,7 @@ char *escape_windows_command_arg(const char *arg);
 
 /* parse_long is like strtol or atoi, but it allows digits only.
    No whitespace, sign, or radix prefix. */
-long parse_long(const char *s, char **tail);
+long parse_long(const char *s, const char **tail);
 
 /* This function takes a byte count and stores a short ascii equivalent
    in the supplied buffer. Eg: 0.122MB, 10.322Kb or 128B. */
diff --git a/nbase/nbase_addrset.c b/nbase/nbase_addrset.c
index be1bb9a27..de14a0de3 100644
--- a/nbase/nbase_addrset.c
+++ b/nbase/nbase_addrset.c
@@ -602,7 +602,7 @@ int addrset_add_spec(struct addrset *set, const char *spec, int af, int dns)
 {
     char *local_spec;
     char *netmask_s;
-    char *tail;
+    const char *tail;
     long netmask_bits;
     struct addrinfo *addrs, *addr;
     struct addrset_elem *elem;
@@ -789,7 +789,7 @@ static int parse_ipv4_ranges(struct addrset_elem *elem, const char *spec)
         } else {
             for (;;) {
                 long start, end;
-                char *tail;
+                const char *tail;
 
                 errno = 0;
                 start = parse_long(p, &tail);
diff --git a/nbase/nbase_misc.c b/nbase/nbase_misc.c
index c11fc796a..24b10b4ea 100644
--- a/nbase/nbase_misc.c
+++ b/nbase/nbase_misc.c
@@ -700,7 +700,7 @@ char *hexdump(const u8 *cp, u32 length){
 
 /* This is like strtol or atoi, but it allows digits only. No whitespace, sign,
    or radix prefix. */
-long parse_long(const char *s, char **tail)
+long parse_long(const char *s, const char **tail)
 {
     if (!isdigit((int) (unsigned char) *s)) {
         *tail = (char *) s;
diff --git a/ncat/http.c b/ncat/http.c
index 29105e34e..270762a9b 100644
--- a/ncat/http.c
+++ b/ncat/http.c
@@ -396,7 +396,7 @@ struct uri *uri_parse_authority(struct uri *uri, const char *authority)
 {
     const char *portsep;
     const char *host_start, *host_end;
-    char *tail;
+    const char *tail;
 
     /* We do not support "user:pass@" userinfo. The proxy has no use for it. */
     if (strchr(authority, '@') != NULL)
@@ -996,7 +996,7 @@ int http_parse_header(struct http_header **result, const char *header)
 static int http_header_get_content_length(const struct http_header *header, int *content_length_set, unsigned long *content_length)
 {
     char *content_length_s;
-    char *tail;
+    const char *tail;
     int code;
 
     content_length_s = http_header_get_first(header, "Content-Length");
@@ -1010,7 +1010,7 @@ static int http_header_get_content_length(const struct http_header *header, int
 
     errno = 0;
     *content_length_set = 1;
-    *content_length = parse_long(content_length_s, (char **) &tail);
+    *content_length = parse_long(content_length_s, &tail);
     if (errno != 0 || *tail != '\0' || tail == content_length_s)
         code = 400;
     free(content_length_s);
@@ -1088,7 +1088,7 @@ static const char *parse_http_version(const char *s, enum http_version *version)
 
     /* Major version. */
     errno = 0;
-    major = parse_long(p, (char **) &q);
+    major = parse_long(p, &q);
     if (errno != 0 || q == p)
         return s;
 
@@ -1099,7 +1099,7 @@ static const char *parse_http_version(const char *s, enum http_version *version)
 
     /* Minor version. */
     errno = 0;
-    minor = parse_long(p, (char **) &q);
+    minor = parse_long(p, &q);
     if (errno != 0 || q == p)
         return s;
 
@@ -1212,7 +1212,7 @@ int http_parse_status_line(const char *line, struct http_response *response)
 
     /* Status code. */
     errno = 0;
-    response->code = parse_long(p, (char **) &q);
+    response->code = parse_long(p, &q);
     if (errno != 0 || q == p)
         return -1;
     p = q;
diff --git a/nsock/src/nsock_proxy.c b/nsock/src/nsock_proxy.c
index 818f4a194..051def360 100644
--- a/nsock/src/nsock_proxy.c
+++ b/nsock/src/nsock_proxy.c
@@ -235,7 +235,7 @@ static int percent_decode(char *s) {
 static int uri_parse_authority(const char *authority, struct uri *uri) {
   const char *portsep;
   const char *host_start, *host_end;
-  char *tail;
+  const char *tail;
 
   /* We do not support "user:pass@" userinfo. The proxy has no use for it. */
   if (strchr(authority, '@') != NULL)
diff --git a/scan_engine_raw.cc b/scan_engine_raw.cc
index 8b4634d86..66780654f 100644
--- a/scan_engine_raw.cc
+++ b/scan_engine_raw.cc
@@ -459,9 +459,9 @@ int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
   bool adjust_timing = true;
   struct timeval rcvdtime;
   struct link_header linkhdr;
-  struct ip *ip_tmp;
+  const struct ip *ip_tmp;
   unsigned int bytes;
-  struct ppkt *ping;
+  const struct ppkt *ping;
   long to_usec;
   HostScanStats *hss = NULL;
   std::list<UltraProbe *>::iterator probeI;
@@ -636,18 +636,18 @@ int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
             if (probe->icmpid() != ntohs(((struct icmp *) encaps_data)->icmp_id))
               continue;
           } else if (encaps_hdr.proto == IPPROTO_TCP && USI->ptech.rawtcpscan) {
-            struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
+            const struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
             if (probe->dport() != ntohs(tcp->th_dport) ||
                 probe->sport() != ntohs(tcp->th_sport) ||
                 probe->tcpseq() != ntohl(tcp->th_seq))
               continue;
           } else if (encaps_hdr.proto == IPPROTO_UDP && USI->ptech.rawudpscan) {
-            struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
+            const struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
             if (probe->dport() != ntohs(udp->uh_dport) ||
                 probe->sport() != ntohs(udp->uh_sport))
               continue;
           } else if (encaps_hdr.proto == IPPROTO_SCTP && USI->ptech.rawsctpscan) {
-            struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
+            const struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
             if (probe->dport() != ntohs(sctp->sh_dport) ||
                 probe->sport() != ntohs(sctp->sh_sport) ||
                 probe->sctpvtag() != ntohl(sctp->sh_vtag))
@@ -726,7 +726,7 @@ int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         }
       }
     } else if (hdr.proto == IPPROTO_TCP && USI->ptech.rawtcpscan) {
-      struct tcp_hdr *tcp = (struct tcp_hdr *) data;
+      const struct tcp_hdr *tcp = (struct tcp_hdr *) data;
       /* Check that the packet has useful flags. */
       if (o.discovery_ignore_rst
         && (tcp->th_flags & TH_RST))
@@ -772,7 +772,7 @@ int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           log_write(LOG_STDOUT, "We got a TCP ping packet back from %s port %hu (trynum = %d)\n", inet_ntop_ez(&hdr.src, sizeof(hdr.src)), ntohs(tcp->th_sport), trynum);
       }
     } else if (hdr.proto == IPPROTO_UDP && USI->ptech.rawudpscan) {
-      struct udp_hdr *udp = (struct udp_hdr *) data;
+      const struct udp_hdr *udp = (struct udp_hdr *) data;
       /* Search for this host on the incomplete list */
       hss = USI->findHost(&hdr.src);
       if (!hss)
@@ -820,8 +820,8 @@ int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           log_write(LOG_STDOUT, "In response to UDP-ping, we got UDP packet back from %s port %hu (trynum = %d)\n", inet_ntop_ez(&hdr.src, sizeof(hdr.src)), htons(udp->uh_sport), trynum);
       }
     } else if (hdr.proto == IPPROTO_SCTP && USI->ptech.rawsctpscan) {
-      struct sctp_hdr *sctp = (struct sctp_hdr *) data;
-      struct dnet_sctp_chunkhdr *chunk =
+      const struct sctp_hdr *sctp = (struct sctp_hdr *) data;
+      const struct dnet_sctp_chunkhdr *chunk =
         (struct dnet_sctp_chunkhdr *) ((u8 *) sctp + 12);
       /* Search for this host on the incomplete list */
       hss = USI->findHost(&hdr.src);
@@ -1747,7 +1747,7 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
   gettimeofday(&USI->now, NULL);
 
   do {
-    struct ip *ip_tmp;
+    const struct ip *ip_tmp;
 
     to_usec = TIMEVAL_SUBTRACT(*stime, USI->now);
     if (to_usec < 2000)
@@ -1807,7 +1807,7 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
     }
 
     if (hdr.proto == IPPROTO_TCP && !USI->prot_scan) {
-      struct tcp_hdr *tcp = (struct tcp_hdr *) data;
+      const struct tcp_hdr *tcp = (struct tcp_hdr *) data;
       /* Now ensure this host is even in the incomplete list */
       hss = USI->findHost(&hdr.src);
       if (!hss)
@@ -1853,8 +1853,8 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         goodone = true;
       }
     } else if (hdr.proto == IPPROTO_SCTP && !USI->prot_scan) {
-      struct sctp_hdr *sctp = (struct sctp_hdr *) data;
-      struct dnet_sctp_chunkhdr *chunk = (struct dnet_sctp_chunkhdr *) ((u8 *) sctp + 12);
+      const struct sctp_hdr *sctp = (struct sctp_hdr *) data;
+      const struct dnet_sctp_chunkhdr *chunk = (struct dnet_sctp_chunkhdr *) ((u8 *) sctp + 12);
 
       /* Now ensure this host is even in the incomplete list */
       hss = USI->findHost(&hdr.src);
@@ -1924,7 +1924,7 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
       const void *encaps_data;
       unsigned int encaps_len;
       struct abstract_ip_hdr encaps_hdr;
-      struct icmp *icmp = NULL;
+      const struct icmp *icmp = NULL;
 
       icmp = (struct icmp *) data;
 
@@ -1980,20 +1980,20 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           continue;
 
         if (encaps_hdr.proto == IPPROTO_TCP && !USI->prot_scan) {
-          struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
+          const struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
           if (ntohs(tcp->th_sport) != probe->sport() ||
               ntohs(tcp->th_dport) != probe->dport() ||
               ntohl(tcp->th_seq) != probe->tcpseq())
             continue;
         } else if (encaps_hdr.proto == IPPROTO_SCTP && !USI->prot_scan) {
-          struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
+          const struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
           if (ntohs(sctp->sh_sport) != probe->sport() ||
               ntohs(sctp->sh_dport) != probe->dport() ||
               ntohl(sctp->sh_vtag) != probe->sctpvtag())
             continue;
         } else if (encaps_hdr.proto == IPPROTO_UDP && !USI->prot_scan) {
           /* TODO: IPID verification */
-          struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
+          const struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
           if (ntohs(udp->uh_sport) != probe->sport() ||
               ntohs(udp->uh_dport) != probe->dport())
             continue;
@@ -2109,20 +2109,20 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           continue;
 
         if (encaps_hdr.proto == IPPROTO_TCP && !USI->prot_scan) {
-          struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
+          const struct tcp_hdr *tcp = (struct tcp_hdr *) encaps_data;
           if (ntohs(tcp->th_sport) != probe->sport() ||
               ntohs(tcp->th_dport) != probe->dport() ||
               ntohl(tcp->th_seq) != probe->tcpseq())
             continue;
         } else if (encaps_hdr.proto == IPPROTO_SCTP && !USI->prot_scan) {
-          struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
+          const struct sctp_hdr *sctp = (struct sctp_hdr *) encaps_data;
           if (ntohs(sctp->sh_sport) != probe->sport() ||
               ntohs(sctp->sh_dport) != probe->dport() ||
               ntohl(sctp->sh_vtag) != probe->sctpvtag())
             continue;
         } else if (encaps_hdr.proto == IPPROTO_UDP && !USI->prot_scan) {
           /* TODO: IPID verification */
-          struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
+          const struct udp_hdr *udp = (struct udp_hdr *) encaps_data;
           if (ntohs(udp->uh_sport) != probe->sport() ||
               ntohs(udp->uh_dport) != probe->dport())
             continue;
@@ -2206,7 +2206,7 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
         goodone = true;
       }
     } else if (hdr.proto == IPPROTO_UDP && !USI->prot_scan) {
-      struct udp_hdr *udp = (struct udp_hdr *) data;
+      const struct udp_hdr *udp = (struct udp_hdr *) data;
 
       /* Search for this host on the incomplete list */
       hss = USI->findHost(&hdr.src);
@@ -2296,7 +2296,7 @@ bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
           if (probe->isPing())
             ultrascan_ping_update(USI, hss, probeI, &rcvdtime, adjust_timing);
           else {
-            struct icmp *icmp = (struct icmp *) data;
+            const struct icmp *icmp = (struct icmp *) data;
             ultrascan_port_probe_update(USI, hss, probeI, PORT_OPEN, &rcvdtime, adjust_timing);
             if (sockaddr_storage_cmp(&hdr.src, &protoscanicmphackaddy) == 0)
               reason_sip.ss_family = AF_UNSPEC;
diff --git a/tcpip.cc b/tcpip.cc
index 970d8b6e0..18b9c76e5 100644
--- a/tcpip.cc
+++ b/tcpip.cc
@@ -191,9 +191,9 @@ void PacketTrace::traceArp(pdirection pdir, const u8 *frame, u32 len,
 void PacketTrace::traceND(pdirection pdir, const u8 *frame, u32 len,
                           struct timeval *now) {
   struct timeval tv;
-  struct ip6_hdr *ip6;
-  struct icmpv6_hdr *icmpv6;
-  union icmpv6_msg *msg;
+  const struct ip6_hdr *ip6;
+  const struct icmpv6_hdr *icmpv6;
+  const union icmpv6_msg *msg;
   size_t msg_len;
   const char *label;
   char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
@@ -326,9 +326,9 @@ void PacketTrace::traceConnect(u8 proto, const struct sockaddr *sock,
                                int socklen, int connectrc,
                                int connect_errno,
                                const struct timeval *now) {
-  struct sockaddr_in *sin = (struct sockaddr_in *) sock;
+  const struct sockaddr_in *sin = (struct sockaddr_in *) sock;
 #if HAVE_IPV6
-  struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sock;
+  const struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sock;
 #endif
   struct timeval tv;
   char errbuf[64] = "";
@@ -386,11 +386,11 @@ void PacketTrace::traceConnect(u8 proto, const struct sockaddr *sock,
 /* Converts an IP address given in a sockaddr_storage to an IPv4 or
    IPv6 IP address string.  Since a static buffer is returned, this is
    not thread-safe and can only be used once in calls like printf() */
-const char *inet_socktop(struct sockaddr_storage *ss) {
+const char *inet_socktop(const struct sockaddr_storage *ss) {
   static char buf[INET6_ADDRSTRLEN];
-  struct sockaddr_in *sin = (struct sockaddr_in *) ss;
+  const struct sockaddr_in *sin = (struct sockaddr_in *) ss;
 #if HAVE_IPV6
-  struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) ss;
+  const struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) ss;
 #endif
 
   if (inet_ntop(sin->sin_family, (sin->sin_family == AF_INET) ?
@@ -435,7 +435,7 @@ struct addrinfo *resolve_all(const char *hostname, int pf) {
 static int send_ipv4_packet(int sd, const struct eth_nfo *eth,
                             const struct sockaddr_in *dst,
                             const u8 *packet, unsigned int packetlen) {
-  struct ip *ip = (struct ip *) packet;
+  const struct ip *ip = (struct ip *) packet;
   int res;
 
   assert(packet);
@@ -469,7 +469,7 @@ static int send_ipv6_packet(int sd, const struct eth_nfo *eth,
 int send_ip_packet(int sd, const struct eth_nfo *eth,
                    const struct sockaddr_storage *dst,
                    const u8 *packet, unsigned int packetlen) {
-  struct ip *ip = (struct ip *) packet;
+  const struct ip *ip = (struct ip *) packet;
 
   /* Ensure there's enough to read ip->ip_v at least. */
   if (packetlen < 1)
@@ -1159,8 +1159,8 @@ u8 *build_igmp_raw(const struct in_addr *source,
    of a TCP packet*/
 int readtcppacket(const u8 *packet, int readdata) {
 
-  struct ip *ip = (struct ip *) packet;
-  struct tcp_hdr *tcp = (struct tcp_hdr *) (packet + sizeof(struct ip));
+  const struct ip *ip = (struct ip *) packet;
+  const struct tcp_hdr *tcp = (struct tcp_hdr *) (packet + sizeof(struct ip));
   const unsigned char *data = packet + sizeof(struct ip) + sizeof(struct tcp_hdr);
   int tot_len;
   struct in_addr bullshit, bullshit2;
@@ -1235,8 +1235,8 @@ int readtcppacket(const u8 *packet, int readdata) {
 /* A simple function I wrote to help in debugging, shows the important fields
    of a UDP packet*/
 int readudppacket(const u8 *packet, int readdata) {
-  struct ip *ip = (struct ip *) packet;
-  struct udp_hdr *udp = (struct udp_hdr *) (packet + sizeof(struct ip));
+  const struct ip *ip = (struct ip *) packet;
+  const struct udp_hdr *udp = (struct udp_hdr *) (packet + sizeof(struct ip));
   const unsigned char *data = packet + sizeof(struct ip) + sizeof(struct udp_hdr);
   int tot_len;
   struct in_addr bullshit, bullshit2;
@@ -1283,7 +1283,7 @@ int readudppacket(const u8 *packet, int readdata) {
 /* Used by validatepkt() to validate the TCP header (including option lengths).
    The options checked are MSS, WScale, SackOK, Sack, and Timestamp. */
 static bool validateTCPhdr(const u8 *tcpc, unsigned len) {
-  struct tcp_hdr *tcp = (struct tcp_hdr *) tcpc;
+  const struct tcp_hdr *tcp = (struct tcp_hdr *) tcpc;
   unsigned hdrlen, optlen;
 
   hdrlen = tcp->th_off * 4;
@@ -1371,7 +1371,7 @@ static bool validateTCPhdr(const u8 *tcpc, unsigned len) {
  * data to the caller.
  */
 static bool validatepkt(const u8 *ipc, unsigned *len) {
-  struct ip *ip = (struct ip *) ipc;
+  const struct ip *ip = (struct ip *) ipc;
   const void *data;
   unsigned int datalen, iplen;
   u8 hdr;
@@ -1492,7 +1492,7 @@ static bool accept_any (const unsigned char *p, const struct pcap_pkthdr *h, int
 }
 
 static bool accept_ip (const unsigned char *p, const struct pcap_pkthdr *h, int datalink, size_t offset) {
-  struct ip *ip = NULL;
+  const struct ip *ip = NULL;
 
   if (h->caplen < offset + sizeof(struct ip)) {
     return false;
diff --git a/tcpip.h b/tcpip.h
index ff4f97a9c..9ffbe8438 100644
--- a/tcpip.h
+++ b/tcpip.h
@@ -136,7 +136,7 @@ class PacketCounter {
    IPv6 IP address string.  Since a static buffer is returned, this is
    not thread-safe and can only be used once in calls like printf()
 */
-const char *inet_socktop(struct sockaddr_storage *ss);
+const char *inet_socktop(const struct sockaddr_storage *ss);
 
 /* Tries to resolve the given name (or literal IP) into a sockaddr
    structure. This function calls getaddrinfo and returns the same
diff --git a/utils.cc b/utils.cc
index d2425e530..b6717e31c 100644
--- a/utils.cc
+++ b/utils.cc
@@ -412,7 +412,7 @@ char *cstring_unescape(char *str, unsigned int *newlen) {
 }
 
 
-void bintohexstr(char *buf, int buflen, char *src, int srclen) {
+void bintohexstr(char *buf, int buflen, const char *src, int srclen) {
   int bp = 0;
   int i;
 
@@ -439,12 +439,12 @@ void bintohexstr(char *buf, int buflen, char *src, int srclen) {
  *  hex spec or NULL in case of error.
  *  @warning Returned pointer points to a static buffer that subsequent calls
  *  will overwrite. */
-u8 *parse_hex_string(char *str, size_t *outlen) {
+u8 *parse_hex_string(const char *str, size_t *outlen) {
   char auxbuff[4096];
   static u8 dst[16384];
   size_t dstlen=16384;
   unsigned int i=0, j=0;
-  char *start=NULL;
+  const char *start=NULL;
 
   if(str==NULL || outlen==NULL)
     return NULL;
diff --git a/utils.h b/utils.h
index 8404d79ba..1d9940fd9 100644
--- a/utils.h
+++ b/utils.h
@@ -115,9 +115,9 @@ void arg_parse_free(char **argv);
 
 char *cstring_unescape(char *str, unsigned int *len);
 
-void bintohexstr(char *buf, int buflen, char *src, int srclen);
+void bintohexstr(char *buf, int buflen, const char *src, int srclen);
 
-u8 *parse_hex_string(char *str, size_t *outlen);
+u8 *parse_hex_string(const char *str, size_t *outlen);
 
 int cpe_get_part(const char *cpe);