diff --git a/oncp.c b/oncp.c
index b0f6d12a..3c7cfa1e 100644
--- a/oncp.c
+++ b/oncp.c
@@ -1002,7 +1002,7 @@ int oncp_mainloop(struct openconnect_info *vpninfo, int *timeout)
 				iplen = load_be16(vpninfo->cstp_pkt->data + 2);
 				break;
 			case 6:
-				iplen = load_be16(vpninfo->cstp_pkt->data + 4);
+				iplen = load_be16(vpninfo->cstp_pkt->data + 4) + 40;
 				break;
 			default:
 			badiplen: