class IP(Structure):
    _fields_ = [('ihl', c_ubyte, 4), ('version', c_ubyte, 4), ('tos',
        c_ubyte, 8), ('len', c_ushort, 16), ('id', c_ushort, 16), ('offset',
        c_ushort, 16), ('ttl', c_ubyte, 8), ('protocol_num', c_ubyte, 8), (
        'sum', c_ushort, 16), ('src', c_uint, 32), ('dst', c_uint, 32)]
Книга Python Sniffing from Black Hat Python