diff --git a/CHANGELOG b/CHANGELOG
index c0520061e..e73158bd0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o Properly display Next-hop MTU value from ICMP Type 3 Code 4 Fragmentation
+  Required messages when tracing packets or in Nping output. Improper offset
+  meant we were printing the total IP length. [Sławomir Demeszko]
+
 o [NSE] Added support for DHCP options "TFTP server name" and "Bootfile name"
   to dhcp.lua and enabled checking for options with a code above 61 by default.
   [Mike Rykowski]
diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
index 7dfee6da0..c28bff68d 100644
--- a/libnetutil/netutil.cc
+++ b/libnetutil/netutil.cc
@@ -2683,7 +2683,6 @@ const char *ippackethdrinfo(const u8 *packet, u32 len, int detail) {
   } else if (hdr.proto == IPPROTO_ICMP) {
     struct ip *ip2;       /* Points to the IP datagram carried by some ICMP messages */
     char *ip2dst;         /* Dest IP in caried IP datagram                   */
-    u16 *nextmtu = NULL;  /* Store next hop MTU when ICMP==Frag required     */
     char auxbuff[128];    /* Aux buffer                                      */
     struct icmp_packet{   /* Generic ICMP struct */
       u8 type;
@@ -2826,8 +2825,7 @@ const char *ippackethdrinfo(const u8 *packet, u32 len, int detail) {
 
           case 4:
             strcpy(icmptype, "Fragmentation required");
-            nextmtu = (u16 *)(&(icmppkt->data[6]));
-            Snprintf(icmpfields, sizeof(icmpfields), "Next-Hop-MTU=%hu", (unsigned short) ntohs(*nextmtu));
+            Snprintf(icmpfields, sizeof(icmpfields), "Next-Hop-MTU=%hu", icmppkt->data[2]<<8 | icmppkt->data[3]);
             break;
 
           case 5: